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VOLUME IV 
IN THE UNITED STATES ARMY 

UNITED STATES 
VS. 

MANNING, Bradley E., PFC COURT-MARTIAL 
U.S. Army, xxx— xx— 9504 

Headquarters and Headquarters Company, 

U.S. Army Garrison, 

Joint Base Myer— Henderson Hall, 

Fort Myer, VA 22211 

/ 

The Hearing in the above— entitled matter was 
held on Monday, June 10, 2013, commencing at 1:35 p.m., 
at Fort Meade, Maryland, before the Honorable Colonel 
Denise Lind, Judge. 
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DISCLAIMER 

This transcript was made by a court reporter 
who is not the official Government reporter, was not 
permitted to be in the actual courtroom where the 
proceedings took place, but in a media room listening 
to and watching live audio/video feed, not permitted to 
make an audio backup recording for editing purposes, 
and not having the ability to control the proceedings 
in order to produce an accurate verbatim transcript . 

This unedited, uncertified draft transcript 
may contain court reporting outlines that are not 
translated, notes made by the reporter for editing 
purposes, misspelled terms and names, word combinations 
that do not make sense, and missing testimony or 
colloquy due to being inaudible by the reporter. 
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PROCEEDINGS, 
(Reconvened at 1:35 p.m.) 

THE COURT: Please be seated. Court is 
called to order. Major Fein? 

MAJOR FEIN: Parties in the last recesses 
are again present, Your Honor. Captain Whyte is absent 
and Captain Overgaard is present . 

THE COURT : All right . During the lunch 
recess that went a little bit longer, a lot longer. 
The parties have presented me with some stipulations of 
expected testimony that both sides have agreed to and 
PFC Manning has agreed to. I count a total of 19 on 
both sides . 

MR. HURLEY: Yes, ma'am. 

MAJOR FEIN: Yes, ma'am. I believe that's 
19, one classified, and then there's an unclassified 
redacted version as well, but it's the same. 

THE COURT : I need to go over these 
stipulations with PFC Manning. Does he have them in 
order or exhibit number? 

MR. HURLEY: He has them in order of 
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prosecution exhibits numbers . 

THE COURT: Excuse me? 

MR. HURLEY: Yes, ma'am. May we wait a 
second just to make sure that ' s right . 

THE COURT : Do it any way . I can do it 
alphabetically or whatever makes sense to you . 

CAPTAIN HURLEY: I apologize. What 
we've done is we've set them up in order of the 
witness testimony according to the witness list 
proposed by the government . So that ' s the order 
that they're currently in now. 

THE COURT: Will it be faster for all to 
take my copies and match them to his orders? 

MR. HURLEY: Ma'am, I think it will be 
faster if we took our copies and matched them to the 
prosecution ID numbers . 

THE COURT: All right. (matching copies) . 

MR. HURLEY: Ma'am, we did our best. 

THE COURT: Thank you. PFC Manning, the 
one question I would want to ask you before we get into 
your colloquy, there's 19 of these stipulations of 
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expected testimony and as I hold them in my hand they 
can be the size of a small paperclip to hold them 
together . 

Have you had an opportunity to read each 
one of these stipulations . Have you had enough time 
to have reviewed all of these and are comfortable 
(INAUDIBLE) to through these with me now. 

THE WITNESS: Yes, ma'am. 

THE COURT : I know some are dated 7 June 
and some are dated 9 and 10 June, and I just noticed 
here on my copy of the redacted classified version 
doesn't have a date. Is that for a reason? 

MR. HURLEY: No, ma'am. 

MAJOR FEIN: No, ma'am, the original 
classified versus indicated 10 June. 

THE COURT: The redacted version? 

MR. HURLEY: Yes, ma'am. 

THE COURT: Now that we've looked at that 
one, I also was advised by the parties who came into my 
office that lasted about two minutes, that a couple of 
these stipulations, and this is — look at the one to 
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Lieutenant commander has been a redacted copy on page 
2 . Look on paragraph 8 . 

It has prosecution exhibit and then it's 
handwritten 87 for identification. The parties 
advised in the 802 witness with the stipulations of 
expected testimony and you made handwritten notes or 
changes on it . 

PFC Manning, would you initiate it, your 
defense counsel would initial it, and the government 
would initial it; but this looks like it was just 
added as part of the original stipulation. 

Is that my understanding of the parties? 

MR. HURLEY: Yes, ma'am, we received them 
from the government. They've already handwritten in 
the prosecution exhibit the time we reviewed it and 
signed it . 

THE COURT: That is correct. 
MAJOR FEIN: Yes, ma'am. 

THE COURT : And PFC Manning you that agreed 

to that? 

THE WITNESS: Yes, ma'am. 
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THE COURT : And based just on the 
stipulations, but didn't know the appellate exhibit 
number, the ones we were referring to at (INAUDIBLE) . 

MR. HURLEY: Yes, ma'am. As we were going 
back and forth on content and once we got down to the 
specifics testimony. (INAUDIBLE) 

THE COURT: Did you tell either side that 
they need to go through and initial these? 



through them one— by— one to make sure we ' re both talking 
about the same thing. Prosecution Exhibit 70 for 
identification, which is stipulation of expected 
testimony from Mr. Peter Artale . 



MR. HURLEY: No, ma'am, not for all 19. 



MAJOR FEIN: No, ma'am. 



THE COURT : All right . Let 



s just go 



MAJOR FEIN: Artale, ma'am. 



THE COURT: Artale. Do you have them. 



THE WITNESS: 



Yes , ma ' am . 



THE COURT: 



And the second one I have is 



Mr . Sean Chamberlin . Do you have that one as 



Prosecution Exhibit 712. 
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THE WITNESS: Yes, Your Honor. 

THE COURT: The next one I have is 
stipulation of expected testimony of Special Agent John 
Wilbar, which is prosecution Exhibit 72 for 
identification . 

THE WITNESS: Yes, ma'am, Your Honor. 

THE COURT: The next one is James Fung, 
Prosecution Exhibit 73 for identification. 

THE WITNESS: Yes, Your Honor. 

THE COURT : And next one is Alex Aithers 
Prosecution Exhibit 74 for identification. 

THE WITNESS: Yes, ma'am. 

THE COURT : The next one is James McManus 7 
June 2013, Prosecution Exhibit 75 for identification. 

THE WITNESS: Yes, ma'am. 

THE COURT : The next one is no Special 
Agent Troy Bettencourt, Prosecution Exhibit 7 6 for 
identification . 

THE WITNESS: Yes, ma'am. 

THE COURT : Next one is Special Agent Kirk 
Ellis prosecution Exhibit 77 for identification. 
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THE WITNESS: Yes, ma'am. 

THE COURT : Next one is Special Agent Mark 
Mander, Prosecution 78 for identification. 

THE WITNESS: Yes, ma'am. 

THE COURT: Next is one is Doug 
Schasteen, Prosecution 80 for identification. 

THE WITNESS: Yes, ma'am. 

THE COURT: Next one is Prosecution 106 for 
identification, Mr. Jacob (INAUDIBLE) . 

THE WITNESS: Yes, Your Honor. 

THE COURT: And next one Ms. (INAUDIBLE) 
white Prosecution Exhibit 107 for identification. 

THE WITNESS: Yes, Your Honor. 

THE COURT : Next one is Lieutenant 
Commander Thomas Hopkins, U.S. Navy Reserve, 
Prosecution Exhibit 111B Bravo. 

THE WITNESS: Yes, ma'am. 

THE COURT : Next one is Lieutenant Colonel 
retired Martin Nehring, Prosecution Exhibit 112 for 
identification . 

THE WITNESS: Yes, ma'am. 
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THE COURT: Next one is Debra van Alstyne, 
Prosecution Exhibit 114 for identification. 

THE WITNESS: Yes, Your Honor. 

THE COURT: Next one is Mr. Wyatt Bora, 
Prosecution Exhibit~115 for identification. 

THE WITNESS: Yes, Your Honor. 

THE COURT : Next one I have is Mr . Patrick 
Hoeffell. Is that how you pronounce his name? 

MAJOR FEIN: Yes, ma'am. 

THE COURT : And that would be Prosecution 
Exhibit~116 for identification. 

THE WITNESS: Yes, Your Honor. 

THE COURT: And then I have CW5 Jon LaRue, 
Prosecution Exhibit~117 for identification. 

THE WITNESS: Yes, Your Honor. 

THE COURT: And then I have Ms. Jacqueline 
Scott which is Prosecution 116 for identification. 

THE WITNESS: I have 119. 

THE COURT : Okay . It looks look 6 to me . 
That would be 119 for identification; is that right? 
MAJOR FEIN: Yes, ma'am. 
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THE WITNESS: Yes, Your Honor. 

THE COURT : Do you have any other 
stipulations of expected testimony that I haven't 
referenced? 

THE WITNESS: No, ma'am. 

THE COURT : Before signing each of these 
stipulations — first of all, are the signatures on the 
backs of these stipulations . 

THE WITNESS: Yes, ma'am, except for the 
redacted one . 

THE COURT: Is your signature on the back 
of the original? 

THE WITNESS: Yes. 

THE COURT: And that would be for the 
record Prosecution Exhibit 11 IB Bravo, Lieutenant 
Colonel Thomas Hopkins . 

MR. HURLEY: What we have redacted and 
Alpha is the original . 

MAJOR FEIN : We ' re Alpha for you if you ' d 
like to look at it right now. 

THE COURT: Let me — before we begin, let 
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me look at that one . Has PFC Manning, has he had an 
opportunity to look at 111 Alpha? 

MR. HURLEY: Yes, ma'am, he has. 

THE COURT : Why don ' t you give it to me 
just so I can see it . 

MAJOR FEIN: May I approach? 

THE COURT : Yes . I'm looking at a copy of 
what's been marked as Prosecution Exhibit 111 Alpha. 
It looks like there are redactions PFC Manning at the 
top and bottom of each page, but the substance of the 
redaction that I want to talk about with you is 
paragraph 16, redacted in the redacted copy. 

Have you had an opportunity to review 
the paragraph 16 in the original exhibit. 

THE WITNESS: Yes, Your Honor. 

THE COURT : You ' ve had the opportunity to 
thoroughly read that? 

THE WITNESS: Yes, it's correct. 

THE COURT : You can take that back . 

PFC Manning, with each of these 19 
stipulations before you signed them, did you read 
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them thoroughly? 

THE WITNESS: Yes. 

THE COURT: Do you understand the contents 
of the stipulations . 

THE WITNESS: Yes, ma'am. 

THE COURT : Do you have approve of the 
content of the stipulations . 

THE WITNESS: Yes, Your Honor. 

THE COURT : Before signing the 
stipulations, did your defense counsel explain the 
stipulations to you? 

THE WITNESS: Yes, Your Honor. 

THE COURT : You understand you have an 
absolute right to the refuse the stipulation, the 
contents of the documents and you should stipulate to 
them only if you believe it ' s in your best interests . 

THE WITNESS: Yes, Your Honor. 

THE COURT: Once all of these stipulations 
or expected testimony, which means that counsel from 
both sides agree the to stipulations for expected 
testimony, you're agreeing that each of these 19 
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witnesses if they were sitting here in the witness 
stand today they would testify substantially as what's 
in the stipulation of expected testimony that ' s geared 
to them and if they were under oath that's exactly what 
they would testify. 

You ' re not agreeing to the truth of what 
they're saying. Their stipulation and testimony can 
be attacked the same way that if the person was 
testifying here live. They can would be 
contradicted and they can be explained in the same 
way as if they were here testifying here in live in 
court. Do you understand that? 

THE WITNESS: Yes, Your Honor. 

THE COURT: And what I've told you earlier 
and what your defense counsel has told you and what 
I've told you today, do you still desire to enter into 
these stipulations? 

THE WITNESS: Yes, Your Honor. 

THE COURT : Did counsel explain the 
contents of each of these 19 stipulations? 

MR. HURLEY: Yes, ma'am. 
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THE COURT : So I admit them as evidence now 
or can we go through — 

MAJOR FEIN : Admit them and we ' 11 read them 
as we go through . 

THE COURT : All right . 

Prosecution Exhibit 7 for 
identification is stipulation of expected testimony 
of Mr. Peter Artale is admitted. 

Prosecution Exhibit 71 for 
identification the stipulation of expected testimony 
of Mr. Sean Chamber lin is admitted. 

Prosecution Exhibit 72, Special Agent 
John Wilbar for identification is admitted. 

I'm not going say stipulation of 
expected testimony with each of these. I'll just 
say, Prosecution Exhibit 73 of James Fung is 
admitted. 

Prosecution Exhibit 74, Mr. Alex Withers 

is admitted. 

Prosecution Exhibit 75, Mr. James 
McManus is admitted. 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/10/13 Afternoon Session 



Prosecution Exhibit 7 6, Special Agent 
Troy Bettencourt is admitted. 

Prosecution Exhibit 77, Special Agent 
Kirk Ellis is admitted. 

Prosecution Exhibit 78, Special Agent 
Mark Mander is admitted. 

Prosecution Exhibit 7 9, Mr. Doug 
Schasteen is admitted. Wait a minute. 

MR. COOMBS: Ma'am, that's Prosecution 

Exhibit 80 . 

THE COURT: Why do I have 7 9 here? 
Prosecution 7 9 is not admitted. 

7 9, Mr. Doug Schasteen, Prosecution 
Exhibit 80 for identification is admitted. 

Prosecution Exhibit~106 Mr. Jacob Grant 

is admitted. 

Prosecution Exhibit 107, Ms. Lorindo 
White is admitted. 

Prosecution Exhibit 111 Alpha, which is 
the classified version, which I can initial later on 
at recess, and Prosecution Exhibit 111B for 
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identification are admitted. 

Prosecution Exhibit 112 Lieutenant 
Colonel retired Martin Nehring is admitted. 

Prosecution Exhibit 113 Ms. Debra van 
Alstyne is admitted. 

Prosecution Exhibit 115 Mr. White Bora 

is admitted. 

Prosecution Exhibit 116, Mr. Patrick 
Hoeffell is admitted. 

Prosecution Exhibit 117, CW5 John LaRue 

is admitted. 

And Prosecution Exhibit 119 
Mr. Jacqueline Scott is admitted. 

Let the record reflect I'm handing all 
of those exhibits back to the court reporter. 

Is there anything that we need to 
address before we proceed? 

MAJOR FEIN: No, Your Honor. 

MR. HURLEY: No, ma'am. 

THE COURT: Call your next witness. 

CAPTAIN MORROW: Call Special Agent Mark 
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Mander . 
Whereupon, 

MARK MANDER, 

called as a witness, having been first duly sworn to 
tell the truth, the whole truth and nothing but the 
truth, was examined and testified as follows: 

DIRECT EXAMINATION 

Q You are Special Agent Mark Mander? 

A Yes . 

Q Investigate unit (INAUDIBLE) CID? 

A Yes . 

Q Agent Mander, how long have you been with 

CID? 

A I've been an agent approximately 11 years. 

Q And you are a civilian agent at this time? 

A Yes, I'm a civilian agent currently. 

Q And describe your career at CID? 

A Beginning in 1994 I became a CID agent as 

military or active duty CID agent, was a military agent 
for about four years, went to the Reserves for three 
years . I then took a break from both reserves or any 
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military service to join the Reserves again in 2007, 
and then in 2008 I became a civilian agent and was also 
a reserve agent at the same time. 

Q When did you joint CCIU specifically? 

A I was hired as a civilian agent in CCIU in 

February of 2008. 

Q And what training did you have to become a 

CID agent? 

A I think in 1994 I went to basically the CID 

school where they teach various aspects of being an 
agent . 

Q And what training have you received related 

to computer crimes as part of your CCIU job? 

A Basically all the agents at CCIU go through 

various training courses at the defense cyber 
investigations training academy, (INAUDIBLE). I've 
attended approximately over 400 hours of courses there. 
The courses range from identifying various computer 
parts and software, doing analysis of computers 
imagining or obtain forensic imaging of computers, 
things of that nature . 
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Q What is CCIU's area of expertise in the 

CCIU world? 

A CCIU is Army CID ' s investigative element 

that is specifically focused on conducting 
investigations involving computer intrusions and 
computer crimes . 

Q And what do you mean by an intrusion? 

A Essentially there are many instances or 

incidents where Army or DoD computer networks are 
intruded upon where someone will remotely try to get 
access or does gain access and obviously that is a 
crime that we investigate . 

Q And do you hold any certifications in 

computer-related fields? 

A Currently I hold a Department of Defense 

certificate computer crime investigator certification. 

Q And approximately how many cases have you 

investigated in the as a CCIU agent? 

A Probably in excess of 20 . 

Q And what about total in CCIU, how many 

cases have you vetted? 
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A Probably in access of 200 cases where I was 

the primary agent or I was helping another agent on 
their case . 

Q I'd like to discuss the investigation of 

PFC Manning at Wikileaks . What has been — or what has 
your role been in the investigation to date? 

A When the investigation first started 

essentially I was a case agent in the investigation 
which means I would do various case related 
investigative duties. 

Q And how did this investigation compare to 

other investigations you've been a part of at CCIU? 

A For CCIU as well as all of the other 

investigations that I've participated as a CCIU agent. 
This was probably one of the largest and most 
complicated investigations we've ever had. 

Q As a case agent, what were you doing 

day-to-day ? 

A My duties involved reviewing various 

documents, either classified documents or open— source 
documents, interviewing personnel that had, you know, 
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some relationship or bearing on the investigation, 
writing reports, collecting evidence, coordinating with 
various other agencies and other personnel to forward 
the case . 

Q And what initially brought PFC Manning to 

law enforcement ' s attention? 

A Initially in — towards the end of May of 

2010 our office received an e-mail that suggested a 
soldier in Iraq had or was or would be wrongfully 
disclosing classified information. 

Q And what organization was initially 

responsible for the investigation? 

A Initially it was Army CID was involved. It 

wasn't the CCIU initially. The case was opened by a 
CID office in Iraq that was assigned the case. 

Q And when did the case get transferred to 

CCIU? 

A I'm going to say probably the second week 

of June, I believe it was maybe the 9th or 10th of June 
or somewhere thereabouts . 

Q Aside from the computer access, why was the 
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case transferred to CCIU in your office specifically in 
the United States? 

A Well, there were several reasons aside from 

kind of computer aspects even when the investigation 
was with the office in Iraq. It was pretty much 
understood that CCIU would conduct the computer 
forensics related to the case, but as the case 
developed we started to understand that there was going 
to be most likely a lot of commercial providers and/or 
other places within the United States that we would 
have to get evidence from such as log files and things 
of that nature . 

Typically in a case where we have to deal 
with commercial providers like say Google or Microsoft 
of the — typically to compel them to provide evidence 
to us. We'll, get a federal magistrate search warrant, 
and a federal magistrate with something that was not 
available in Iraq. They don't have a federal 
magistrate over there. So that was another reason that 
the case was transferred to us . 

Q Now, does CCIU itself work with the 
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assistant U.S. attorneys and federal magistrates often? 
A Yes, very often, because — 

MR. TOOMAN: Objection, Your Honor. 

Relevance . 

THE COURT : Overruled . 

THE WITNESS: We work with assistant U.S. 
attorneys and federal magistrates very often. 
Generally because when a computer intrusion incident 
occurs a lot of times it ' s not apparent what the source 
of that intrusion is and, therefore, it's not always a 
soldier, therefore, we wouldn't (INAUDIBLE) SJ or a 
trial counsel initially. 

BY MR. MORROW: 

Q Other than the source, sort of the need to 

interact with the commercial providers in order to 
obtain search authorizations, any other reasons why the 
case was better suited for or why the case was 
transferred to CCIU in the United States? 

A We discussed the obviously computer aspect 

of it . The fact that there would be federal 
magistrates most likely involved to compel the 
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commercial providers. There was also, you know, maybe 
not so obviously, but personnel within the United 
States that knew Manning as well as we also developed 
there was indications that there was persons that he 
had met with or had been in contact with in the Boston 
area during or before his time in Iraq as well as 
during the time he was on leave. 

Q And how did the evidence get from Iraq to 

the United States? 

A There was — initial evidence was collected 

in Iraq that basically the agents there had collected 
and that evidence was brought from Iraq via one of the 
these agents who was going on leave who hand carried 
the evidence with him from Iraq to the Washington, D.C. 
area and I met him in the airport . 

Q You met him at the airport? 

A I did what that was that . 

THE COURT: What airport? 
BY MR. MORROW: 

Q What airport was that? 

A Does the Dulles International Airport . 
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Q And when approximately was that? 

A I would have to look at the evidence 

documents it would probably sometime in the second week 
of Julian right about there I believe. 

Q And once you met that the agent at Dulles 

what did you do next? 

A We basically invented the items that he had 

hand carried pertain evidence vouchers that he also had 
and then I signed footer items and then I hand cared 
them to our evidence room at CCIU. 

Q And once the evidence was in the unit the 

states how did the investigation progress from a there? 

A Initially we looked at various pieces of 

evidence . The forensic team of CCIU began examining 
the evidence that had been received as well as evidence 
that had been collected in other places and based on 
the examination of that evidence . 

The forensic team would then a — the 
investigative team to lead or investigative matters 
that needed to be followed up. 

Q And at this point when the evidence was 
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transferred, was the case very well developed? 

A No, the case was just developing 

essentially . 

Q And what were you — what were the cases 

using to track down leads? What was being revealed by 
the examinations by the forensic examiners? 

A Well, for example, on some of the digital 

media that was collected in Iraq that I believe there 
were chat logs between PFC Manning and Mr . Lamo that 
were correspond to do chat logs between Mr . Lamo and 
PFC Manning from digital media that is what collected 
from Mr. Lamo. 

So looking at those chat logs as well as 
other information that was contained on the digital 
media that is what going examined such as there was I 
mean from PFC Manning I believe it was his personal 
computer those items of information that were you know 
in those digital media items created invest leads to 
identify certain people to interview them. 

Q And what did the chat logs reveal regarding 

sort of the scope of the alleged translations or 
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compromising information? 

CAPTAIN TOOMAN: Objection, Your Honor. I 
mean, the chat log. 

MR . MORROW : I'm asking a very general 
question, Your Honor, to add to his testimony. 

THE COURT : Are you going to go down and 
(INAUDIBLE) as before. Overruled. 

THE WITNESS: Can you repeat the question, 

sir? 

BY MR. MORROW: 

Q What was revealed in the chat logs that 

provided sort of context to the compromise or the 
alleged compromises of information? 

A I'm not following, sir. 

Q Who was the recipient of information 

allegedly comprised by PFC Manning? 

A According to the chat logs and other next 

it appeared that the organization Wikileaks was the 
recipient of information. 

Q And what is Wikileaks? 

A Wikileaks, to my knowledge, is a 
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organization which its mission is to obtain and 
publicly display or public documents from governments 
and other private organizations. 

Q And when did the Wiki leaks organization 

become widely known? 

A It was probably widely known following the 

disclosure of a video involving U.S. Army helicopter 
involved in combat operation. 

Q And what was released during that — what 

was the release essentially can you describe what was 
released by Wikileaks? 

A It was on April 5th of 2010 Wikileaks or 

members of Wikileaks held a press conference type of 
event where they displayed and/or published an edited 
version of a video taken from an Army helicopter 
involved in a combat operations. 

Q What do you mean by an, edited video? 

A Some my knowledge the video was edited from 

the original video . 

CAPTAIN TOOMAN: Objection, Your Honor. 
This witness has no personal knowledge of any editing 
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on the video . 

THE COURT: Does he? 
BY CAPTAIN MORROW: 

Q Agent Mander, are you familiar with the 

video, the Apache video? Have you seen the Apache 
video in its full form as part of this investigation? 

A I don ' t remember having seen the original 

video, but I know from looking at the version that was 
released by Wikileaks, it had been edited because there 
was certain information that wouldn ' t have been 
contained in the original such as names of some of the 
personnel that was casualties in the video . 

Q And you said the Wikileaks organization, is 

it a website you said it publishes information? How 
does it publish information? 

A The Wikileaks organization has a website. 

The domain name is Wikileaks.org, or ORG, and they also 
have several other we call them mirror websites that 
contain generally the same content as the main site. 

Q What do you mean by a, mirror website? 

A When I say mirror I mean that there were 
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additional websites using other domain names that 
appear to have been hosted physically in other 
countries or other jurisdictions I guess you could say 
that would contain the same content as the main site 
and presumably with the intent so that if the main site 
was ever taken down by some type of government order 
or — 



this witness would have no knowledge of why it would be 
multiple sites. 

THE COURT: Sustained unless there was a 

foundation . 

BY MR. MORROW: 



CAPTAIN TOOMAN: Objection, Your Honor, 



Q 



Do your knowledge, Agent Mander, is the 



Wikileaks website still active? 



A 



It's still active. 



Q 



And who can access the website? 



A 



Any member of the general public . 



Q 



Who was the public face or leader of the 



Wikileaks? 



A 



There is a Mr. Julian Assange is kind of 
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the self —described leader or editor of Wikileaks . 

Q Agent Mander, I want to talk about the 

structure of the organization when it came back to the 
United States . Outside of CCIU, what other 
investigative organizations were involved in the 
investigation of PFC Manning? 

A Initially the Department of State 

Department in particular, or DSS, was involved in 
investigating the compromise and/or unlawful disclosure 
of a I, believe it was a diplomatic cable relating to 
information involving Iceland, and that had occurred 
several months before CID was involved in the 
investigation . 

Q And other than the DSS what other 

organizations were involved? 

A Initially when we received information from 

or should I say that information was developed about a 
son— in— law? Iraq possibly unlawfully disclosing 
information Army military intelligence was also 
involved because efficiently there was a concern that 
possibly foreign intelligence service could be involved 
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as well as the state department and Army military 
intelligence . 

Q Any federal law enforcement authorities? 

A Later, probably in late June or maybe July 

the FBI also became involved. 

Q What was the status of the investigation or 

did the various investigative organizations, were they 
working together? 

A Yes, they we call it joint investigation 

and what that means is that the investigative agents 
each determine that they will work together and 
typically they will define kind of investigative leads 
specific to that agency's interest that they will 
pursue . 

Q And what was CCIU's claim essentially? 

A CCIU was to investigate all Army and/or DoD 

related investigative leads . 

Q And what was the FBI ' s link? 

A The FBI this would be investigating any 

(INAUDIBLE) leads that didn't really have like a 
Department of Defense or Army and/or nexus . 
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Q Generally did the investigative 

organizations share information? 
A Yes. 

Q And what about investigative activities, 

did the various organizations stay in their lane or did 
you all do, conduct investigative activities together? 

A Yes . There ' s numerous instances such as 

various interviews that were done jointly. So, for 
example, there was at least one interview that I 
conducted where there was CID Army and/or military 
intelligence as well as the DSS agents participated in 
the interview . 

Q And as part of this investigation 

approximately how many individuals have you 
interviewed? 

A I would have to go back and look at the 

case file, but I would say probably at least 25 or 
more . 

Q And are you familiar with agents 

investigative reports? 

A I'm familiar, yes. 
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Q And approximately how many reports have you 

filed as part of this investigation? 

A Again, I'd have to review the case file, 

but I would say probably, probably in access of at 
least 50. 

Q I want to talk about some other 

investigative activity that CCIU conducted in relation 
to this case. As part of the investigation, did CCIU 
preserve or collect information that was posted on the 
Wikileaks website? 

A It at various points I believe there was 

agents that were assigned to download information that 
was published on the Wikileaks website because it 
contained classified information and was otherwise 
evidence . 

Q And what would be the benefit of collecting 

information from there? How was that information used? 

A The information that was collected from the 

Wikileaks website would be used for comparison purposes 
to information that may be found on digital media that 
was collected in the case from various cases, from 
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various sources . 

CAPTAIN TOOMAN: I will object to their 
line of questioning the witness said that other agented 
are the ones that downloaded. So it's not his personal 
knowledge . 

MR. MORROW: Your Honor, I think I've 
established his personal knowledge of the entire 
investigation . 

THE COURT : Overruled . 
BY MR. MORROW: 
Q Is that a typical investigative activity 

for CCIU? 

A What — 

Q Preserving and collecting information in 

websites . 

A In some cases, yes. 

Q Now, based on your knowledge and 

experience, are there ways to observe a website as it 
appeared on a certain date? 

A There are certain tools that would allow 

you to see what a website looked previously. 
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Q And what are some of those tools? 

A One tool that we will so occasionally use. 

It's a website that uses the domain name icon.org and 
it also has a nickname . We call it the wayback 
machine . 

Q And are there any other ways that you might 

observe a website as it appeared at a certain date 
prior? 

A I know that Google is also a potential 

source Google as it looks at websites to catalog them 
for search results that sometimes saves a, what we 
call, a cached version of that website. 

Q Can you explain how an agent or how would 

you use Google cache to see how a website may appear on 
a certain day? 

A Well, for example, some of what recently I 

was searching for a particular term to see if I could 
find something and sometimes especially DoD computer 
networks may be blocked from going to certain websites 
because of either the nature of the website or 
sometimes make a key word such as something involving 
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something sexual will be automatically blocked through, 
you know, filtering. 

So to get around this issue sometimes you 
can look at the Google cached version and get an idea 
of what the website that you're looking for looks like. 

Q How would you access the Google cache 

version versus the website that's being blocked? How 
does it appear to you on the screen when you are 
accessing the Google cache (INAUDIBLE) ? 

A Generally you put your search terms in the 

Google website would you hit search and you would then 
receive results, and then typically there is — it 
depends on what time or era we're talking about, but 
right now presently there's like a little arrow next to 
the one of search results and then you can choose to 
see the cache version versus the actual version. 

Q And the cache version, does it indicate 

that date that the website was saved or downloaded or? 

A Typically when you view the cached version 

at the top portion of the version that you'll see it 
will say something to the effect of, this is Google's 
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version of this website on whatever date and time, and 
it also will give you a caveat that the website may 
have changed since then. 

Q And you mentioned the Internet archive or 

archive.org, can you explain how you might use that to 
observe a website in the past? 

A That tool is little more comprehensive . 

Q First let's start with this then. What is 

the Internet archive or archive . org? 

A It ' s a website that was established. It 

seemed to be funded by some type of nonprofit 
organization that their goal is to catalog websites on 
the Internet, amongst other things. 

So what they're website does is it appears 
to periodically go out and download the content of 
websites and then it saves them for retrieval by the 
general public that want to use or see what a 
particular site looked like in the past . 

Q Now, in your experience as an agent, have 

you used the Internet archive or archive . org to see how 
a website might have looked in the past? 
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A Yes. There's been occasions where we have 

been site, involved an investigation may have been 
taken down by the time that we want to look at it and 
thereafter we would like to see when it previously 
looked like and, therefore, we might use that tool as a 
way to see what a website looked like in the past. 

Q So take me through how you might use the 

Internet archive or archive.org and describe from the 
beginning and we ' 11 try to go through is this slowly? 

A Assuming that you have a web browser and 

computer connected to the Internet, would you open up 
the web browser window, you would navigate to the 
archive . org website . 

On that website there is a place we can 
enter in text of what you want to see . So you ' d 
presumably put in the address or uniform resource 
locater code for the websites that you're interested 
in . 

You would then hit a search button at which 
point if the website has been achieved or cataloged 
within archive . org you would be shown something that 
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resembles like a calendar and that calendar will have 
little circles for days that it captured of the website 
that you've typed in has been archived at which point 
you can then click on the little circles and see that 
version of that website that has been archived. 

Q And it ' s that version of that website 

that ' s linked to a date? 

A Yes . There will be like a date and time 

sometimes some websites are cataloged archived more 
than once per day. 

Q Now, once you've clicked on that date, what 

happens ? 

A Typically the website for the day and/or 

time that you've clicked on will then display and you 
will see, generally speaking, what that website looked 
like on that day and time. 

Q Now, if you printed that web page from the 

Internet archive, what would happen? 

A If you printed that page you would get a 

printout of generally what was on the screen, and 
depending on the browser settings, most browsers have 
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the ability to include the thing you've printed, the 
address of the website as well as the date and time and 
maybe, say, like the number of pages and/or the total 
of the website. 

Q I'm retrieving what's been marked as 

Prosecution Exhibit 109 for identification. 
THE COURT: Proceed. 

CAPTAIN TOOMAN: The defense requests the 
opportunity to voir dire this witness about his 
knowledge of the that machine or archive.org, how it 
functions . 

THE COURT: With the goal of venting 
visibility of this exhibit . 

MR. COOMBS: I would object to foundation, 
personal knowledge of this witness and I'd like to voir 
dire in light of that objection. 

THE COURT : Let me see the exhibit . Why 
don ' t we do this again . I have two roles here . One of 
them as the military judge, that would be in every 
case, for motions to decide the legality or nonlegality 
of something coming in . 
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In that role I will allow that 
government at least, at this point, to go forward 
with the questions on what their foundation would be 
with respect to admitting this exhibit and then I ' 11 
allow the defense to voir dire the witness and 
decide your objections . 

Should I rule in favor of the defense 
and not of this exhibit, (INAUDIBLE) does that make 
sense? 

MR. COOMBS: Yes, Your Honor. 

MR. MORROW: Yes, Your Honor. 

THE COURT: Proceed. Let me see what that 
exhibit is first . 

BY MR. MORROW: 
Q I'm handing the witness what's been marked 

as Prosecution Exhibit 109 for identification. 

Do you remember that document, Agent 

Mander? 

A I do. 

Q And what is it? 

A In appears to be a version of the most 
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wanted leaks of 2009 list that was obtained from the 
archive . org website . 

CAPTAIN MORROW: Permission to publish to 
the Court, Your Honor. 

THE COURT: Proceed. 

BY CAPTAIN MORROW: 
Q Agent Mander, I want to focus mainly on 

sort of the bottom of this page, specifically the line 
at the very bottom that starts with HTTP://. 

Do your see that? 
A Yes . 

Q Can you explain just by looking at that 

line what this web image or what this printout shows or 
what exactly that means down at the bottom? 

A As I mentioned, when you print a document 

using your web browser various web browsers will allow 
you to include in the header or footer of what you ' re 
printing. Information such as the URL of the document 
you're printing. 

So, for example, based on this footer here, 
this would be a document that was printed from the 
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address that ' s listed there that starts with the 
HTTP:// (INAUDIBLE) 

Q What are the numbers . It says / and then a 

web again? What are the numbers to the right starting 
with 2009? What does that indicate? 

A As far as my knowledge, that would be the 

date and the time of the capture of the website which 
follows after the numbers the HTTP : //Wikileaks . org . 

Q And, again, what does it say at the end 

after Wikileaks.org? 

A /wiki /draft :v_ (INAUDIBLE) and then it 

looks like the whole URL is too long (INAUDIBLE) . The 
dots kind of indicate there's more. 

Q Now, as part of this case, Agent Mander, 

have you had the opportunity to see whether the website 
still exists even outside of using the archive.org? 

A The Wikileaks? 

Q The Wikileaks website, and specifically the 

2009 draft. The website you just looked. 

MR. TOOMAN: Objection. Relevance of what 
Wikileaks.org looked like today. Not relevant, Your 
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Honor . 

THE COURT: Where are you going with this? 

CAPTAIN MORROW: Your Honor, between what 
how it looked in the past and how the website still 
appears today, (INAUDIBLE) . 

THE COURT: You're asking this witness if 
this witness can find that document today? 

CAPTAIN MORROW: Yes, exactly. 

THE COURT : That ' s overruled . 

BY CAPTAIN MORROW: 
Q Agent Mander, please, explain how you would 

find this document or this web page today? 

A That particular document I believe I used 

some key words and conducted a search using Google, and 
one of the first or maybe one of the first full results 
was that document that is actually or was on the 
Wikileaks website as of just a couple of weeks ago. 

Q I'm going to show you what ' s been marked as 

Prosecution Exhibit 110 for identification. 

THE COURT : Are you going to have the same 
objections to this one? 
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CAPTAIN TOOMAN: Can I see it, Your Honor? 
Can I have a moment, Your Honor? 
THE COURT : Yes . 

CAPTAIN TOOMAN: (INAUDIBLE) . 
BY CAPTAIN MORROW: 
Q Agent Mander, I'm handing you what's been 

marked as Prosecution Exhibit 110 for identification. 
Can you take a look, please? 
A (Witness reviewing document.) 

Q Do you recognize that document? 

A Yes this is a document similar to the one 

that you just showed me. It is a version that you 
would find in the Wikileaks.org website as of June 1st. 
Q And how do you know that? 

A I went to the site and printed out this 

document and where I've initialed the bottom above the 
date and time on each page. 

Q How was that document created? You created 

it? 

A I printed it, yes. 

CAPTAIN MORROW: Permission to publish to 
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the Court , Your Honor . 

THE COURT: Proceed. 

BY CAPTAIN MORROW: 
Q Agent Mander, how is this web page 

organized? 

A From generally speaking, it looks like — 

Q Do you need the exhibit back? 

A Sure . 

At the top of the document it says the word 
draft coal the most wanted leaks 2009— sort and 
generally speaking below that there is somewhat of like 
a table of contents which are links, and each of the 
links represents the various countries in alphabetical 
order to include like a miscellaneous category of 
international organizations and then below that are 
listed various countries and below each country appears 
to be a list of documents or other information. 

Q Does the United States appear on that list? 

A The United States does appear on this list . 

Q And what page is that? 

A It begins on page 9 and appears to go to 
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page 11 . 

CAPTAIN MORROW: Your Honor, permission to 
publish page (INAUDIBLE) to the Court. 

THE COURT: Proceed. 
BY CAPTAIN MORROW: 
Q Agent Mander, at this time, I'd like you to 

move to the panel box, please, if you would? 
A What ' s the panel box? 

Q Right here . 

I ' m handing Agent Mander what ' s been 
admitted as Prosecution 81. Mr. Mander, Agent Mander, 
I'd like you to scroll down to 28 November in that 
Exhibit . 

A Okay . 

Q And I'd like you to look at lines 27 

through 33 . 

A (Witness reviewing document . ) 

Okay . 

Q The last 27 to 33, what do they say? 

A The whole line or just the action? 

Q The action line, please. 
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A From line 27 the action column reads 

retention plus sign of plus sign interrogation plus 
sign videos . 

Q On this list found on this website, do you 

see any similar information? 

A Move on up to the top of the document . 

Q Let me help you . Do you see anything under 

military intelligence? 

A On the second bullet there ' s a CI detainee 

interrogation news, it appears there. 

Q And, again, like for you to scroll to that 

what you're looking at. Scroll to lines 114 and 115, 
please . 

A Okay . 

Q What do you see? What's the action there? 

What's the information? 

A Line 114 reads, interrogation plus tapes 

and line 115 it reads, interrogation plus video. 

Q Agent Mander, now, I'd like to go back to 

2 9 November please and lines 43 and 44 specifically. 

A Okay . 
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Q And have you found that? 

A I have . 

Q What are the lines, what do those reads? 

A The action column it reads, detainee plus 

abuse and that's for 33, and line 44 is the same 
detainee plus abuse . 

Q And does similar information exist on the 

military tory intelligence of this web page? 

A On the fourth bullet the words detainee 

abuse photos, withhold by the Obama administration. 

Q I'd like to go to 30 November, line 62. 

A Okay . 

Q And what does that line read? 

A The action column also reads, detainee plu 

abuse . 

Q Now, I want you to go to a serious of 

searches starting to 8 December. I'm looking 
specifically at — if you could refer to lines 100 
through 111. 

A Line 100, the action column reads, 

Guantanamo plus detainee plus operations . 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/10/13 Afternoon Session 



54 

Q Read all of them down to 111. 

A The next line JTF plus GTMO . The next line 

is JTF plus GTMO plus SOP . Next line is CJTF plus 82 
plus detainee plus SOP . Next line is CJATF plus 82 
plus detainee plus plus operations. Next line is JTF 
plus GTMO plus SOP plus interrogation. Next line is 
CJTF plus 101 . Next line is JTF plus GTMO plus SOP 
plus interrogation. 

The next line is, SOP plus interrogation. 
The next line is, JTF plus GTMO. The next line is JTF 
plus GTMO plus SOP . The next line is JTF plus GTMO 
plus Delta plus SOP. The next line is, human plus 
rights plus campaign. 

Q First what ' s SOP mean to you as somebody 

who ' s been in the military? 

A Generally that ' s an abbreviation for an 

acronym for standard operating procedure. 

Q And what does delta mean to you in the 

context of these searches? 

A I would assume that would be (INAUDIBLE) 

which is a portion of Guantanamo Bay and the detainee 
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facility there. 

Q A those lines 100 through 111, is any 

similar information or items appear in this list here. 
I ' 11 give you a moment . I would ask you just to review 
all the way down . When you see something that catches 
your eye, please, let me know. 

A (Witness reviewing document . ) 

On the seventh bullet use the word Camp 
Delta (INAUDIBLE) Delta (INAUDIBLE) Guantanamo 
standard operating procedure 2005, 2009. To bullets 
below that is the words unredacted inquiry into 
treatment of detainees and U.S. custody 20 
November 2008. A few bullets below that is the words 
Camp Delta Guantanamo standard operating procedure 
2005, 2009. Below that is Camp Delta Guantanamo 
interrogation versus operation procedure 2003-2009, and 
it appears to be all what I see. 

CAPTAIN MORROW: Your Honor, at this time 
prosecution moves 109 and 110 and. 

THE COURT: I'm going to allow it. Are you 

finished? 
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CAPTAIN MORROW: No, no, I'm not, actually. 
I have a few more questions to go through regarding 
different exhibits but I can stop now, if you like. 

THE COURT: Why don't we stop now. I'll 
let the defense voir dire and we'll get a little bit 
out of order and we'll (INAUDIBLE) that issue and go 
forward with the rest of your direct . 

CAPTAIN MORROW : I'm replacing page 9 in 
the prosecution ID 110 . 

THE COURT: Can the witness go back to the 

chair? 

CAPTAIN TOOMAN: 

MR. MORROW: The witness can go back to 
the chair, Your Honor. 

THE COURT : All right . 

CAPTAIN TOOMAN: We would object to 
Prosecution Exhibit 110 as hearsay. 

MAJOR FEIN: (INAUDIBLE) retrieving 
Prosecution Exhibit 81 for the witness . 

THE COURT : All right . 

CAPTAIN MORROW : I ' ve handed the court 
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reporter 110 for ID. 

VOIR DIRE EXAMINATION 

Q I want to talk to you a little bit about 

archive do the organize. The Prosecution Exhibit 109 
for identification, you didn't actually visit 
Wikileaks.org in 2009, did you? 

A No, not 2009. 

Q So you didn't actually see what their 

website looked like in 2009? 

A In 2009 I did not actually go to the 

website and see it. 

Q And with archive . org what you see is what 

they tell you was there? You didn't actually see what 
was there in 2009? 

A If I go to archive.org I see what is 

presented for the date that they say that it was there . 

Q Okay . You don ' t have any knowledge of how 

archive.org actually compiles their data, do you? 

A I do not. I have various, I guess, you can 

say, assumptions of how it works based on my knowledge 
in the field. 
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Q But you don ' t know where that data comes 

from? 

A Which data? 

Q The data that ' s on archive . org . 

A I would assume that it comes from the sites 

that are presented that they archive . 

Q So you don ' t know where it comes from? You 

don't know how the data is gathered? 

A Technically, no, I don't know how that data 

is gathered. 

Q You don't know how often that data is 

gathered? You don ' t know the frequency of that data 
gathering? 

A I can say that the frequency appears to be 

just periodic. It doesn't seem to have a set schedule 
just based on the results that are available. 

Q And you don ' t know if that ' s all of the 

data because you didn ' t actually go to the website in 
2009, correct? 

A The website . 

Q So in this case we ' re talking about the 
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Wikileaks most wanted list. You didn't actually go to 
in it 2009. So we're looking at it or archive.org, you 
don't know if anything is missing, correct? 

A That would be a fair statement . 

Q Now, you mentioned on direct that when you 

go to archive . org there are some todays that are 
missing . 

Do you know why that is? 

A I don ' t believe that I said there ' s some 

days that were missing. 

Q I think you said that the calendar would 

come up and you can click on a day and then if you had 
the ability to click on the day that means that 
archive.org is saying that you have a website for that 
day, but I would massage you can't click on every day, 
can you? 

A You cannot . 

Q So there are days missing? 

A There are days when the archive.org website 

does not appear to have archived that website . 

Q Do you have any knowledge of whether or not 
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a website could embed code to their website that would 
prevent archive.org from gathering their website? 

A I believe there is a file that web host or 

web masters can put on their site called robot. text, 
and other archiving type sites are supposed to respect 
that file, and in that file you can put in certain key 
words I believe that be tell other sites, not to 
archive or safe copies of your file or your website . 

Q Do you know where the archive . org servers 

are located? 

A I have no direct knowledge of that . 

Q Do you know when archive . org gears their 

information? 

A You mean like time of day? 

Q Time of day. 

A Based on the results that are displayed on 

their website for various given sites it appears to be 
just periodic. It doesn't appear to be any particular 
time of day, day of week, or any other pattern that I 
can discern. 

Q Are you aware of whether or not are there ' s 
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ever been any hack attempts on the cache servers 
employed by archive . org . 

A I do not have any direct knowledge, but I 

would be surprised if there were not any hacks . 

Q Do you have any knowledge of the operating 

system that the servers are running? 

A I do not have knowledge of what operating 

systems they're running. 

Q Do you have any knowledge as to whether or 

not there are backups of servers? 

A I do not have any direct knowledge of that . 

Q Were you actually there when the particular 

website you were talking about today, were you there 
when it was cached by archive . org? 

A Was I — when you say there? 

Q Were you actually there when whoever from 

archive.org gathered what they say was this website, 
were you actually there when they did it? 

A I was not at archive . org wherever their 

location, when that was archived. 

Q You talked a little bit about a robot. text 
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file that a company would or person could put on their 
website. Do you have any knowledge whether Wikileaks 
had one of those on their website? 

A I do not have any knowledge of that . 

CAPTAIN TOOMAN : One moment , Your Honor . 
Please, Your Honor, we have no further voir dire 
questions of this witness . We would objection to 
Prosecution Exhibit 109 for identification because 
this, where it says has no personal knowledge of how 
archive . org operates . 

There are a number of cases that are 
considered the admissibility of archive.org. 

THE COURT : You plan to present those to me 

when? 

CAPTAIN TOOMAN: Right now, Your Honor. 
THE COURT : Thank you . 

CAPTAIN TOOMAN: I will note first that 
none of those cases are criminal cases, they all are 
civil cases dealing with either trademark or pattern 
law. One of them is (INAUDIBLE) Telamuso . Pardon my 
pronunciation . 
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THE COURT : Why don ' t we do this : You can 
read them on the record, but if you're going to present 
me cases can I have a Xerox copy of them? 

CAPTAIN TOOMAN: Yes, ma'am. One of them 
is — this is a Polish pronunciation. (INAUDIBLE) . 

THE COURT : Yes . 

CAPTAIN TOOMAN: It's 2004 westlaw 
WL2367740. And in that case the Court required and 
affidavit from the wayback machine from the proprietors 
of the wayback machine before they would allow 
admissibility and also St. Luke's Cataract site, 2006 
westlaw 130242. 

In that case the Court precluded the 
admissibility of the wayback machine absent 
testimony from someone with personal knowledge. In 
that case the Court wanted actually someone from 
Wikileaks . In this case they would wanted someone 
from Wikileaks to come and talk about what was 
actually on their website at the time. 

So our objection to presumption 
Exhibit 109 for identification would be 
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authentication as well as double hearsay, and we 
will, of course, get you those cases, Your Honor. 

THE COURT: Thank you, and your objection 
to prosecution 110 is hearsay? 

CAPTAIN TOOMAN: Yes, ma'am. 

THE COURT: Okay. 

Government, do you have any case 
authority to read? 

CAPTAIN MORROW: The government believes 
there are some more recent cases, Your Honor, with 
respect to the (INAUDIBLE) issue wherein have the 
Delaware state issue. I don't think it's a Delaware 
state issue. 

Agent Mander ' s testimony was very clear 
that is a battle state printout that was a 
representation of the archive.org website capturing 
another website . 

THE COURT: So are you offering it for the 
truth of the matter asserted or not? 

CAPTAIN MORROW: We're offering both of 
exiting for (INAUDIBLE) . 
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THE COURT: Okay. The hearsay objection 
Exhibit 110, is overruled. So if you don't have any 
other objections to Prosecution Exhibit 110 I'll admit 
that . 

CAPTAIN TOOMAN: We would also based on 
relevance. There is no evidence that PFC Manning ever 
saw this particular website. So (INAUDIBLE) and that 
the defense (INAUDIBLE) that it's not relevant. 

THE COURT: What else, the relevance? 

CAPTAIN MORROW: Your Honor, I believe 
Agent Mander used Prosecution Exhibit 81 to go through 
and provide circumstantial evidence through his 
testimony of user of those computers searching for 
information very similar to information of the similar 
site . 

THE COURT: What's the difference between 
Prosecution Exhibit for identification 109 and 110. 

MR. MORROW: There's no difference, Your 
Honor. We'll leave the issue alone if the 
Prosecution Exhibit 110 is admitted. 

THE COURT: Wait a minute, let's go back 
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Prosecution Exhibit . I may have to go to just remind 
the witness (INAUDIBLE) . 

Prosecution Exhibit 110, what is it and 
what did you do to get it? 

THE WITNESS: Can I see the two exhibits? 
To answer your question, ma'am, I believe the one 
exhibit is directly from the Wikileaks website which 
was recently within the last couple of weeks and the 
other version is the archive.org version of the same 
document as captured, reportedly captured in 2009 by 
the archive . org website . 

THE COURT: Prosecution Exhibit 110 was 
your testimony that you basically Googled the Wikileaks 
website and there that document was and you printed it . 

THE WITNESS: How can I tell (INAUDIBLE) . 

THE COURT : So the one he printed himself 
is Prosecution Exhibit 110. 

CAPTAIN MORROW: Yes, ma'am. 

THE COURT : Tell me how you got the 
Prosecution Exhibit 110. 

THE WITNESS: I went directly to the 
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Wikileaks.org website and printed out the document that 
I had on my screen. 

MR . HURLEY : Just with respect to the 
Prosecution Exhibit 110 for identification, those are 
relevance objections based on this was — I believe it 
date on that it ' s 1 June . 

THE COURT : I'm going to overrule that . 
That's the date, that 1 June the document (INAUDIBLE) 
has a different date. That is in the document that's 
on the website. So what is your argument, it's going 
to weight, not of admissible. 

CAPTAIN TOOMAN: We just think that the 
date 2009 there's no approve or evidence that that was 
actually up on the website in 2009 nor is there 
evidence that PFC Manning actually saw in it 2009. 

THE COURT: I understand all of that. Now, 
with respect to Prosecution 109, I will take that under 
advisement. I will consider the authority offered by 
both sides and make a ruling probably tomorrow morning. 
Do you have cases to give me as well? 

CAPTAIN MORROW: We have several cases that 
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we — yes , we do . 

THE COURT: In hard copy? 

CAPTAIN MORROW: Yes, Your Honor. 

THE COURT : Depending on the voluminous 
amount, my ruling may not come tomorrow morning, but it 
will be coming. 

CAPTAIN MORROW: I'm taking Prosecution 110 
and Prosecution 109. 

THE COURT: Can I see Prosecution Exhibit 

110? 

CAPTAIN MORROW: Yes, Your Honor. 

THE COURT: Prosecution Exhibit 110 is 

admitted. 

BY CAPTAIN MORROW: 
Q Agent Mander, are you familiar with the 

term, social media? 

A Yes, I am. 

Q What is social media? 

A General term, social media, refers to 

either websites and/or systems that encourage members 
of the general public to create accounts and then 
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encourages them to communicate with each other . 

Q What are some examples of social media 

website? 

A Some examples might include website 

Facebook, website MySpace as well as Twitter as an 
example . 

Q What is Twitter? 

A Twitter is both a website as well as I 

guess you can consider it software that runs in various 
platforms that allows members of the general public to 
submit short messages which other members of the 
general public can then follow or subscribe to. 

Q During the course of an investigation, do 

you recall having seen a Wikileaks organization Twitter 
feed? 

A Yes, the Wikileaks organization has a 

Twitter account . 

Q And what is the user name or handle of that 

account ? 

A I believe it ' s just Wikileaks . 

Q And generally why do people use Twitter? 
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What's the purpose of it? 

A Personally I would say for entertainment, 

however, you could also use it as a method to 
disseminate information generally widely to the public. 

Q And how is Twitter set up? You know, my 

understanding of Facebook is, you know, you have 
friends and those friends can see your Facebook 
website. How is Twitter set up? 

A Twitter is generally set up in that any 

member of the general public can create an account in 
which they can then post short messages . 

Other members of the general public can 
either view those messages by serving for that use 
other their website or they can subscribe to that 
user's Twitter feed which is a long running collection 
of messages directly and then presumably they get those 
messages in real time, or near real time, as they are 
submitted to the system or the site . 

Q And Wikileaks Twitter feed you referred to 

earlier the Twitter account that access can on the 
Internet? 
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A It is accessible by the general public on 

the Internet . 

Q And you said there ' s a feed, what do you 

mean by, a feed? Just that explain that again, please. 

A I would describe the Twitter feeds as 

basically a collection of the messages that have been 
submitted by a particular user account and they appear 
generally in chronological order with the most recent 
message at the top of the feed. 

Q And have you observed the Wikileaks Twitter 

feed recently? 

A Somewhat repeatedly, yes . 

Q And how active is that feed? 

A It appears to be very active. There were 

messages about when I last saw it about this trial 
occurring . 

THE COURT: When was that? 

THE WITNESS: I believe that was also — 
CAPTAIN TOOMAN: Objection, Your Honor, 
relevance . The recent feeds of Wikileaks go to any 
element of the charges of this case of PFC Manning. 
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THE COURT: Tell me the last time you 

accessed it. 

THE WITNESS : Sometime after the beginning 
of the Manning trial . Maybe the 3rd or 4th of June of 
this year. 

THE COURT: What is relevant to that? 

CAPTAIN MORROW: I'm just laying a 
foundation of the witness ' knowledge of the Twitter 
feed that ' s all Your Honor . 

THE COURT: That's all. I'll consider it. 
Okay . Go ahead . 

Before you continue your testimony was 
that software that runs on various platforms, what 
is a platform? 

THE WITNESS: A platform could be 
considered a computer, a smart phone, tablet, different 
types of computer hardware, Your Honor. 

THE COURT : Thank you . 

BY CAPTAIN MORROW: 
Q Now, have you reviewed — when you recently 

reviewed the Twitter feed, the Wikileaks Twitter feed, 
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could you tell whether there had been tweets or were 
the tweets from you know several years ago still 
available to you? 

A It appears that all of the publicly 

published messages from any given account are remain on 
the site indefinitely. 

Q And we talked about the Internet archive 

previously. Now, do you have to use the Wikileaks or 
have you had to use the Internet access tweets 
(INAUDIBLE) from the past or are those tweets still 
available? 

A When I attempted to look at Twitter 

messages on Internet archive I received a message 
saying those were unavailable, and I generally assumed 
because of the volume of messages that are in archive 
does not archive or catalog those . 

Q I'm showing you Prosecution Exhibit 32 for 

identification . 

CAPTAIN MORROW: I'm showing it to 
defendant ' s counsel . 

BY CAPTAIN MORROW: 
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Q Agent Mander, I'd like you to go to the 

second of page on this exhibit . If you would, would 
you please — do you recognize that document? 

A Yes, I do. 

Q And what is it? 

A This is a printout of the Google 1 s cached 

version of a Twitter message sent on the Wikileaks 
Twitter account . 

Q And, again, what's the Google? When you 

say it's the Google cached (INAUDIBLE), what do you 
mean by that? 

A It is the version that Google saves as a 

search result that you can use to view a particular 
website if for some reason that website is maybe 
unavailable directly. 

Q Now, do you have to use the Google 

passwords do access the Wikileaks feed? 

A You do not . 

Q Let ' s talk about that specific printout . 

Is the tweet dated? 

A The message is dated. It's dated 8/ or 
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possibly 6 January of 2010. 

CAPTAIN MORROW: Your permission to publish 
to the Court . 

THE COURT: Go ahead. 
BY CAPTAIN MORROW: 

Q That's kind of hard to see, Agent Mander, 

but I want to talk about some of the sort of graphics 
behind the message. Have you seen — first, can you 
describe sort of that graphic? 

A The background graphic appears to be 

repeated four times horizontally. It appears to be I 
guess describe as two globes that are in an hour glass 
and they appear to be top upper most one appears to be 
dripping to the lower one . 

Q And have you seen that graphic like that 

before? 

A That appears to be the logo or graphic that 

is typically permanently displayed on the Wikileaks 
website . 

Q Now, Agent Mander, you said this is a 

representation of something you printed, or explain 
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exactly what this is again, please? 

A Sometimes we take what we call a screen 

capture which is a — we can use various types of 
software to actually take what ' s called a picture of 
the computer screen monitor, whatever we're looking at 
and then save it as a graphics file . 

So you ' 11 actually see in the bottom 
right— hand corner some of the information from my 
computer as well as one of the windows I had opened 
down in the bottom. That's kind of hard to see from 
this, but it's there. 

Q And did you — what do you after you 

observed this on the web page? What did you do? 

A I believe I took a screen capture of the — 

when I was looking at and this item was printed out 
and — can you move it up so I can see the bottom? 

Q Sure . 

A On the very bottom is the time and date of 

when this item was printed, and those are my initials 
that I actually put on the printed page . 

CAPTAIN MORROW: Your Honor, the 
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prosecution offers Prosecution Exhibit 32 for 
identification. This is Prosecution Exhibit 32. 

CAPTAIN TOOMAN: We will object, Your 
Honor. Again, personal knowledge. We use a web cache. 
Didn't actually view the tweet on the date reported to 
be and also relevance because, again, not I guess 
viewed on 1 June so (INAUDIBLE) and I guess personal 
knowledge of how Google — 

THE COURT : Do you want to voir dire the 
witness with respect to his personal knowledge on 
Google cache? 

CAPTAIN TOOMAN: I would like to. 

CAPTAIN MORROW: May I ask you a few 
questions, Your Honor? 

THE COURT : Yes . 

BY CAPTAIN MORROW: 
Q With regard to this tweet, can you read the 

tweet? 

A The message that is tweeted is, have 

encrypted videos of U.S. bomb strikes on civilians 
http://bit.ly/wlafghan2 need super computer time. 
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Http : / / 1 j s f . org . 

Q Again, is that tweet dated? 

A It appears to be either 6 or 8 January of 

2010 . 

Q And have you seen that tweet before in 

another context other than the Google's cache? 

A This tweet is also on the Wikileaks Twitter 

account . 

Q So how would you find that tweet on the 

Wikileaks Twitter account? 

A One of two ways . You could either do a 

search for it using something like Google and then go 
directly to the Twitter page that has that message or 
you could go to Twitter look for the Wikileaks account 
and then presumably scroll did you look all of their 
messages newly found this particular one. 

Q Have you done that as part of this case? 

A I did the first mentioned way . There was I 

believe like thousands of Twitter messages . So I did 
not read every single one. 

Q But you read this one? 
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Yes, I saw this one. 
And you printed this one? 
I did. 

Do you recall when that was? 

That was sometime ago . That was maybe last 



A 

Q 
A 

Q 
A 

year . 

CAPTAIN MORROW: 

the witness. 

THE COURT: Are 
CAPTAIN MORROW: 
respect to that . 

THE COURT: You 
CAPTAIN MORROW: 

coming . 

THE COURT: Are 

objection? 

CAPTAIN TOOMAN: 
THE COURT: Why 
you ' 11 get your chance . 



I'm taking exhibit from 

you finished? 
Yes, Your Honor, with 

have more coming? 
I have more one tweet 

you anticipating the same 

Yes . 

don't we go through it and 



BY CAPTAIN MORROW: 
Q I'm retrieving Prosecution Exhibit 31 for 
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identification from the court reporter. I'm handing 
the witness what's been marked as Prosecution Exhibit 
31 for identification. 

Agent Mander, do you recognize that 

document ? 

A Yes , I do . 

Q And what is it, and, again, concentrate on 

the first page? 

A This document is a screen capture showing 

another tweet from a Wikileaks website as cached by 
Google . 

Q And what date is that tweet? 

A The date of the tweet is 7 May 2010. 

Q And what's the content of the message? 

A The message reads, we would like a list of 

as many dot e-mail addresses as possible. Please 
contact editor at sign Wikileaks.org or submit. 

Q And you used this tweet using Google cache 

on your computer? 

A I did. 

Q What did you do after you observed the 
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tweet? 

A I took a screen capture and then printed 

out that screen capture, and initially the printed page 
was printed out . 

Q And did you do that at the same time as the 

other tweet we just talked about? 

A Roughly at the same time . 

Q Approximately? 

A Yes . 

Q And with respect to Prosecution Exhibit 31 

for ID, you talked — we previously talked about the 
background . I'm handing it back to you . The 
background text, the graphics, and, again, where have 
you seen these that background text of graphics? 

A The background graphics appear to be 

identical to the other tweet, and I've seen the same 
similar graphic on the Wikileaks.org website. 

Q Have you seen that message before in the 

Wikileaks Twitter feed, not in a Google cache form? 

A Yes. It's still available on the actual 

Twitter account of their feed from the Wikileaks 
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Twitter account . 

Q When did you see that tweet in the regular 

Wikileaks? 

A That was sometime ago, and I don't remember 

the exact date . 

Q Was it approximately the same date as you 

the saw the other tweet? 

A Yes . 

Q And, again, what did you do at that time 

with that tweet? 

A Essentially something similar, took a 

screen capture or printed the tweet onto paper and then 
initialed that piece of paper. 

CAPTAIN MORROW: I'm retrieving Prosecution 
Exhibit 31 for identification and handing it to the 
court reporter. Your Honor, we would move to admit 
this exhibit for identification as well. 

THE COURT: All right. I assume the same 

objection? 

CAPTAIN TOOMAN: Yes, ma'am. 

THE COURT: Okay. What is your objection 
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to Prosecution Exhibits 31 and 32? 

CAPTAIN TOOMAN: Your Honor, we would 
object to hearsay. We would also object that the 
witness has no personal knowledge and can't 
authenticate them. No personal knowledge of how Google 
creates their cache . 

THE COURT: If I'm understanding the 
government's position, they're not offering it to admit 
(INAUDIBLE) that basis, they're offering to admit it on 
the prior or both, what are you doing? 

CAPTAIN MORROW: Your Honor, we actually 
have the prior version printed and that was produced in 
discovery as well . The reason we didn ' t — 

THE COURT: On what basis are you moving to 
add in these? 

CAPTAIN MORROW: Excuse me? 

THE COURT: On which basis are you going to 
admit these two exhibits . 

CAPTAIN MORROW: We are not offering either 
exhibit for the truth. We're offering it for 
(INAUDIBLE) . 
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THE COURT: Are you offering the Google 
will cache or are you offering the prior look? 

CAPTAIN MORROW: We're offering the prior 
look and we'll actually add that as an exhibit Alpha to 
these exhibits. The reason that we didn't have them on 
this dates is when we printed it ' s very hard to see the 
date of the tweet . So we used this color version to 
mark as an exhibit so that the date could be readable . 

We can — we will certainly — can 
attach or mark the other version that Agent Mander 
as printed and initialed as well. 

THE COURT : All right . Go ahead captain . 
CROSS EXAMINATION 
Q Just a few questions about your knowledge 

of Google cache and Twitter. Do you personally have a 
Twitter account? 

A I do not . 

Q Do you have any knowledge of how Twitter 

archives their messages? 

A When you say — can you be more specific? 

Q Do you know how they do it? 
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A I don ' t know . 

Q Do you know the process they go through in 

order to save tweets? 
A No. 

Q Do you know if a tweet can be deleted? 

A I do not know for certain, no. 

CAPTAIN MORROW: A (INAUDIBLE) printout of 
a web page, so his knowledge of Twitter is not 
necessarily or relevant . 

THE COURT : I'm going to overrule that . 
Go ahead . 

BY CAPTAIN TOOMAN: 

Q Agent Mander, I want to talk to you about 

Google cache . Do you know how Google goes about 
creating their cache? 

A Specifically the technical aspects, no. 

Q Do you know where their servers are 

located? 

A I believe they have servers located in many 

places . 

Q Do you know where the servers are located 
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that service the cache? 
A I do not . 

Q Do you know how often Google goes out and 

creates their cache, how often they go out and grab 
data? 

A I do note . 

Q And do you know if they use a program or a 

proprietor algorithm in order to grab that information? 
A I would assume, yes, they do. 

Q You assume that, but do you actually know? 

A I do not . 

Q Do you know the frequency with which Google 

goes out and grabs information? 
A I do not . 

Q Do you know if there's any way that a web 

page would prevent Google from grabbing it? 

A I believe the robot. text file that we 

talked about before is a method. 

Q Adds you answered before when we were 

talking about tack archive.org. Do you also not know 
whether Wikileaks.org employees (INAUDIBLE) one over 
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those for their text files? 

A I do not know if they employ one of those 

text files . 

Q There are a couple of dates on these tweets 

that were hard to read. Did you ever actually look at 
Twitter on those dates? 

So 6 January or 8 January, 2010, did you 
look at the tweet that day? 

A I did not . 

Q Do you know if the Google cache servers 

have ever been hacked? 

A I do not know that . 

Q Do you know if anyone has ever tried to do 

that? 

A I do not know that . 

Q Do you know the operating system that 

Google cache runs? 

A I do not know that . 

Q Do you know if they have backups of their 

servers? 

A I have no actual knowledge of that , no . 
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CAPTAIN TOOMAN: Your Honor, we would renew 
our objections authentication for Prosecution Exhibit 
31 for identification and 32 for identification as well 
as is hearsay, Your Honor, and we'll address. 

THE COURT : I believe the government told 
me that they're offering it for nonhearsay purposes; is 
t hat co r r e ct ? 

CAPTAIN MORROW: We are, Your Honor. 

THE COURT: What is that? 

CAPTAIN MORROW: With respect for the 
tweets we're offering for (INAUDIBLE) that is the 
e-mail . 

THE COURT: I'm sorry, I interrupted you. 
Authentication and hearsay with respect to Prosecution 
Exhibit 31 and 32, right? 

CAPTAIN TOOMAN: Yes. 

THE COURT: About prosecution 109 you have, 
your objection to that one was? 

CAPTAIN TOOMAN: 109 would be the same, 
Your Honor, as well as relevance. 

THE COURT: Do you have any redirect? 
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CAPTAIN MORROW: A couple of questions. 
REDIRECT EXAMINATION 
Q Do you know how to use the Internet? 

A Yes . 

Q Do you know how to navigate a web page on 

the Internet? 

A Yes . 

Q And in this case have you navigated to web 

pages on the Internet? 
A I have . 

Q And give me a couple of example of web 

pages you've navigated to on the Internet as part of 
the investigation? 

A The Wikileaks website, the Facebook profile 

of PFC Manning, the Twitter messages that we've 
discussed as well as the archived versions of various 
other sites. More examples? 

Q No, I think that's enough. Thank you. 

THE COURT: All right, temporarily excuse 
this witness or permanent excuse. 

CAPTAIN TOOMAN: I was personally under the 
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impression that I just voir dired the witness . 

THE COURT: You have further cross 

examination? 

CAPTAIN TOOMAN: Yes, ma'am. 

THE COURT: I didn't realize that. You're 
still under direct examination. 

CAPTAIN MORROW: I'm looking for my direct, 
so give me a second. 

THE COURT: Would the this been a good time 
to recess the Court for about ten minutes . 

CAPTAIN MORROW: Absolutely, Your Honor. 

CAPTAIN TOOMAN: No objection, Your Honor. 

THE COURT: The Court is in recess until 

1715 . 

(Hearing recessed at 1717 p.m.) 
(Hearing resumed at 1725 p.m.) 
THE COURT: You're still under oath. 

(INAUDIBLE) 

CAPTAIN MORROW: At this time the 
prosecution has no further questions . 

THE COURT : Captain Tooman . 
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CAPTAIN TOOMAN: Before I begin my cross 
examination I'd like to ask two voir dire questions of 
the witness with respect to the tweets and the 
government assertion that they would like to admit it 
for the effect of the listener. 

THE COURT: Okay. 

VOIR DIRE EXAMINATION 

Q Agent Mander, did you do find any evidence 

that PFC Manning — over the course of your 
investigation, did you find any evidence that PFC 
Manning actually reviewed those tweets? 

A I personal did not . 

Q Did you look for that evidence? 

A I did not personally look for that 

evidence . 

CAPTAIN TOOMAN: I guess for our objection, 
Your Honor, were that relevance if there's no the 
evidence that PFC Manning actually saw at tweets there 
could be no effect on him. 

THE COURT: So you have three objections to 
all three of them? 
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CAPTAIN TOOMAN: Yes, ma'am. 

THE COURT: (INAUDIBLE), authentication, or 

hearsay . 

CAPTAIN TOOMAN: Yes, ma'am. 
THE COURT: Got it. 
BY CAPTAIN TOOMAN: 
Q Agent Mander, I'd like to talk just a 

little bit about your investigation generally. Sort of 
the tenant of your profession that if you do something 
you document it . 

A Yes . 

Q And you had — if you find a lead or a clue 

you're going to document that as well? 
A Yes. 

Q If you talk to a witness you'll document 

that? 

A Yes . 

Q If you researched something and uncover 

something relevant to the investigation would you 
document it? 

A Yes . 
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Q Now, over the course of your investigation 

in this case you did a lot of different types of things 
you talked about on direct examination. You did 
witness interviews? 

A Yes . 

Q I think you reviewed e-mails? 

A Yes . 

Q You've reviewed chats? 

A Yes . 

Q You also reviewed financial transactions? 

A Could you be more specific? 

Q Did you look at bank records as well? 

A I don't remember specifically looking at a 

banking records personally . 

Q Okay . So when you ' re looking at those 

various things, if you have something important you put 
it up, you write it down in an AIR and you notify 
everyone who is involved that we have this lead and 
let's go after this, correct? 

A Generally speaking, yes. 

Q Now, thinking about all the things that you 
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looked at in this case you looked at chats and e-mails 
and witness interviews . When you were investigating 
this case you knew what PFC Manning was accused of, 
correct? 

A Generally, yes. 

Q You knew generally what the charges were 

against him? 

A Depending on what point of the 

investigation initially, no, there weren't any charges 
for extended period of time . I believe the charges at 
some point were modified, and I don't know the legal 
term for that but . 

Q Okay . But when they were charges you knew 

what they were and when the charges changed you knew 
what they were at that point as well? 

A Generally speaking, yes. 

Q Over the course of your investigation you 

didn ' t find any evidence that PFC Manning had 
antiAmerican beliefs, correct? 

A Well, as we discussed when we had an 

interview, yourself and myself, there was one thing 
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that I mentioned to you that was brought up by the 
witness of this case. 

Q But not a witness you personally 

interviewed? 

A Correct . 

Q So in the course of your investigation, and 

I just want to talk about the things you did and the 
things you looked at and the people you talked to . 

A Okay . 

Q You didn't find any evidence or any 

indication that PFC Manning was antiAmerican that he 
hated America? 

A No. 

Q You also didn't find any evidence that PFC 

Manning was trying to help the enemy, that he wanted to 
affirmatively give something to the enemy? 

A Is that a question? 

Q Yes . You never found anything in witness 

interviews, chats, e-mails where PFC Manning said 
something like I want to help the enemy? 

A I did not find anything where he said he 
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wanted to help the enemy . 

Q Okay. You also reviewed a lot of 

communications with individuals and you would have 
noted any contact with the more than nationals you 
would have noted, correct? 

A Correct . 

Q And you found out some because PFC Manning 

lived in whales nor a while so you had foreign contact 
right? 

A Yes . 

Q For a while that was kind of a focus of 

your investigation you thought that maybe PFC Manning 
was working for some sort of foreign intelligence 
service, correct? 

A That wasn't really the CID focus. That was 

probably more of the Army military intelligence focus . 

Q But when you were conducting your 

interviews you certainly explored that idea, didn't 
you? 

A Yes, that was a question I would have 

asked. 
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Q And you didn't find any evidence that he 

was associated with any sort of foreign intelligence 
service, correct? 

A I did not personally find that, no. 

Q You also didn't find any evidence that PFC 

Manning was paid in any way or had any releases he may 
have done? 

A I did not personally find out find any 

information that he was paid. 

Q I'm going to retrieve what's been marked as 

Defense Exhibit fox trot for identification. 

I'm handing you defendant's Exhibit fox 
trot for identification to the witness . 

Agent Mander, do you recognize that 

document ? 

A Yes, I do. 

Q What is it? 

A This appears to be a printout of a web page 

on Wikileaks.org website. 

Q How do you know that? 

A I printed this out and my initials appear 
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on the lower right— hand corner of each page . 
Q How did you find that document? 

A This document is a variation of the other 

documents that the prosecution mentioned earlier. 

THE COURT: Which other document? 
THE WITNESS: I believe it's Exhibit 110, 
if I'm not mistaken. 

CAPTAIN TOOMAN: Prosecution 110, Your 

Honor . 

THE WITNESS: And this document, the other 
document as well as some other information relating to 
this most wanted leaks of 2009 document were revealed 
via search on the Internet specifically using Google. 
BY CAPTAIN TOOMAN: 
Q And you did that search? 

A I did that search. 

Q And you printed that document? 

A I printed that document . 

Q I'm going to retrieve document fox trot for 

identification. I request permission to publish 
(INAUDIBLE) available? 
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THE COURT: Proceed. 
BY CAPTAIN TOOMAN: 

Q (INAUDIBLE) now, you testified about a 

similar document on direct . What is different about 
this document, Agent Mander? 

A Well, the most notable difference from 

Exhibit 110 on the top there where it says draft colon 
the most wanted leaks of 2009. On the other document 
Exhibit 110 document at the end of 2009 there's the 
word hyphen and then the word sort , S— O— R— T . 

Q Would you agree with me that this document 

also includes a little bit more information at the top 
of the document? 

A The documents are similar, but different . 

Q Would you agree that defense Exhibit fox 

trot has more introductory information than prosecution 
110? 

A Yes in the list of countries on the right 

versus the left and there ' s obviously some other 
differences as well . 

Q The biggest difference would be, you would 
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agree with me, I'm pointing you to the very first 
paragraph here at the pop . That paragraph does not 
appear on the version introduced by the government, 
correct? 

A I would have to see both documents again. 

Q Okay. I'll retrieve prosecution 110. 

CAPTAIN TOOMAN : I'm going to hand 
Prosecution 110 to the witness. 

THE WITNESS: I'm sorry, could you repeat 
your question? 

BY CAPTAIN TOOMAN: 
Q Would you agree that the introductory 

portion of the defense Exhibit fox trot for 
identification is not included on Prosecution Exhibit 
110? 

Just there on the first page — actually, 
look through the entire document and just make sure for 
me that it doesn ' t appear anywhere in there . 
A (Witness reviewing document . ) 

The paragraph on the displayed version does 
not appear to be in this document . 
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CAPTAIN TOOMAN: I'm going to retrieve 
Prosecution 110 for the witness. 

THE COURT: May I see both of those 
exhibits quickly. Have you introduced yours yet? 
CAPTAIN TOOMAN : Not yet . 
THE COURT: Go ahead. 
BY CAPTAIN TOOMAN: 
Q You would agree with me with this version 

defense, Exhibit fox trot, includes more information 
about how this list was populated, correct? If you 
need to take a moment to read that, please, do. 

A This version is an editable version so that 

general members of the public can edit this version. 

Q And what this version says at the top is 

that the most wanted leaks, the concealed documents 
(INAUDIBLE) the concealed documents are recordings most 
sought after by countries journalists, activists, 
historians, lawyers, police, or human rights 
investigators. Do you agree with that? 

A That's a paraphrase of what it says, sir. 

Q A paraphrase or literally what it says? 
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A Paraphrase of what it says . 

Q Okay. We'll try it again. 2009 's most 

wanted leaks-the concealed documents are recordings 
most sought after by a countries journalists, 
activists, historians, lawyers, police, or human rights 
investigators? 

A That ' s literally what it says . 

Q And that paragraph didn ' t appear on the 

prosecution exhibit, correct? 

A It did not . 

Q And you would agree with me that this 

demonstrates kind of the purpose of Wikileaks . Would 
you agree with that? 

A Can you be more specific? 

Q Sure . You would agree what this statement 

at the beginning sits out why Wikileaks wants these 
documents they want it because they have been? 

CAPTAIN MORROW: Objection, Your Honor, 

speculation . 

THE COURT: Ask some foundational questions 
about whether he knows that why Wikileaks wants 
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documents . 

BY CAPTAIN TOOMAN: 
Q Agent Mander, do you know why Wikileaks 

want s do cument s ? 

A I don ' t have the actual knowledge of were 

they want specific documents. I presume that. 

THE COURT : You presume based on? 

THE WITNESS : My experience knowledge of 

this case. 

BY CAPTAIN TOOMAN: 

Q Would this document also aid your 

presumption? 

A Can you clarify your question. 

Q When reading this introductory paragraph 

does that I guess informed your understanding of why 
Wikileaks wants documents? 

A It just seems to say that in 2009 those are 

the most wanted documents by those groups of people . 
It doesn't necessarily say why Wikileaks wants them. 

Q Let ' s move down to this paragraph . Can you 

see where I'm pointing here? I'm pointing to the 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/10/13 Afternoon Session 



104 

paragraph that starts with document are other materials 
added (INAUDIBLE) must and you would agree with me that 
it says can likely to have political, diplomatic, 
(INAUDIBLE) and historic impact on release? 
A That is what it says . 

Q Okay. Now, having read that and seen that, 

does that inform your understanding of what Wikileaks, 
the purpose of Wikileaks and what they want? 

A My understanding of this document is that 

they were trying to create a list of documents that 
would be the categories listed below where I just 
pointed out, things that are political, diplomatic, or 
other things that would be impactful. 

CAPTAIN TOOMAN: Your Honor, at this time 
the defense offers Exhibit fox trot for identification 
of defense Exhibit fox trot . 

THE COURT: Any objection? 

CAPTAIN MORROW : One moment , Your Honor . 

Your Honor, the objection would be 
authentication. We're not sure what this document 
purports to be based on at least the witness' 
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testimony . 

THE COURT: All right. Tell me one more 
time, Prosecution Exhibit 110, which I do admit. I'm 
not asking the government, just the witness a question 
here. Prosecution Exhibit 110 I would like to see that 
exhibit now, if I could, and defense Exhibit fox trot 
again . 

Special Agent Mander Prosecution Exhibit 
110 you've already testified that it's different 
from defense Exhibit fox trot . Both of those 
exhibits, defense fox trot for identification have 
your initials and printed Saturday, June 1st on the 
bottom right; is that correct? 

THE WITNESS: That is correct. 

THE COURT : It looks like the one defense 
Exhibit 110 is printed at 1539:36 and the difference 
Exhibit fox trot for identification was 1637:47. So 
defense Exhibit fox trot came after the government 
exhibit? 

THE WITNESS: If that's the way the times 
( INAUDIBLE ) yes , ma ' am . 
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THE COURT: I just want to ask the witness 
a couple of questions. I'm going to hand you both of 
the exhibits and can you just walk me through how you 
got them both and what you did? 

THE WITNESS : There was some other 
documents that accompanied these. Are those available? 

CAPTAIN MORROW: Your Honor, those have 
been produced in discovery, but they're not part of the 
exhibit . 

THE COURT: Okay. Can you tell me what you 
did without referencing those particular documents . 

THE WITNESS: Ma'am basically conducted a 
search using I believe the words the most wanted leaks 
of 2009 using Google. There were numerous results that 
came as a result of that search and the first I believe 
it was the first four contained three versions of this 
list or similarities to this list and the prosecution 
Exhibit 110 is one version of that list. 

I guess defense Exhibit — excuse me, 
fox trot is another version of this list, and there 
was additionally a third shorter version as well as 
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a video related to the list . 

THE COURT : And did you print — you 
printed both versions yourself, right? 

THE WITNESS: I believe I printed all three 

versions . 

THE COURT : Thank you . Government 
objection is authentication and I admit Prosecution 
Exhibit 110. What's the basis for admission on the 
authentication? 

CAPTAIN MORROW: Your Honor, the objection 
is relevance. I'm not sure what the relevance of this 
specific exhibit is . 

THE COURT: Well, if prosecution Exhibit 
110 is relevant why isn't this one relevant? 

CAPTAIN MORROW: The foundation for this 
one might be relevant. Additionally, Your Honor, we'd 
also object on the basis of hearsay. What are they 
offering it for? 

THE COURT: Go ahead. 

CAPTAIN TOOMAN: Would you like me to 
respond to that? 
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THE COURT: Yes, please. 

CAPTAIN TOOMAN: Your Honor, I guess most 
notably admitted there ' s the exact same thing done the 
exact same way so it should be admissible. With 
respect to hearsay we would say rule 106 completeness 
if this is basically the same version. If you look at 
you recall it is identical with the exception of a 
hyphen sort . 

THE COURT: Are the same URL with the 
exception of the hyphen sort, we need to put that on 
the two exhibits . 

You pulled it up, you got — normally 
when you search Google something you get a list of 
things . 

THE WITNESS: Yes, ma'am. 

THE COURT: So they listed one, two, three, 

four or? 

THE WITNESS : There was — I believe there 
was ten results as a result of the search on the page 
initially the Google results and then within the first 
four results were different versions of this list, and 
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these are two versions of that list . 

THE COURT: I'm going to overrule the 
objection. Anything else? 

CAPTAIN MORROW: We (INAUDIBLE) assume the 
truth of the statement or the truths of the statement . 

THE COURT: Why does the rule of 
completeness assume the rule of completeness? 

CAPTAIN MORROW: (INAUDIBLE) 

THE COURT: Rule 106 do formal 
(INAUDIBLE) be one document if part of the document 
that ' s admitted than you decide to bring in the rest 
of the document . 

CAPTAIN MORROW: May I ask him a couple of 
questions about the difference of the document? 

THE COURT: Go ahead. 

BY CAPTAIN MORROW: 
Q Agent Mander, you said that you searched 

for Wikileaks most wanted and came up with a number of 
results? 

A Yes . 

Q What does that mean when a number of 
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results come up? 

A Could you be more specific. 

Q Were they in the same location on the 

Internet? 

A Both documents were on the Wikileaks.org 

website . 

Q But it wasn't exactly, you had to navigate 

from that website to another place on the website; is 
t hat co r r e ct ? 

A When I initially went to the main 

Wikileaks.org recently on June first you could not 
directly navigate to either one of these litigations. 

Q But the — okay . 

CAPTAIN MORROW: No further questions. 
THE COURT : Now I ' m confused again . You 
printed out those documents and they say June 1st . How 
would you print them out if you never got them? 

THE WITNESS : When I used Google I used the 
search term the most wanted leaks of 2009. That 
resulted in numerous search results . These were two of 
those results. If you go to the Wikileaks.org website 
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directly without searching for it there are many links 
and other various bits of information on this page, 
however, there is nothing that will immediately take 
you, or nothing you can click on that will take you to 
either one of these lists, their main web page, their 
home page . 

Does that make it any clearer, ma'am? 

THE COURT : Let me just make sure I 
understand your testimony. You went on Google and this 
isn't Google cache, this is just Google? 

THE WITNESS: Just Google. 

THE COURT: And you found the difference 
between fox trot and prosecution 110 in your search? 
THE WITNESS: Yes, ma'am. 

THE COURT : And they come up two of the ten 
results that you found? 

THE WITNESS: Yes, ma'am. 

THE COURT: And then if on June 1st — and 
you printed it ought off Google? 

THE WITNESS: I printed it off the actual 
location where the documents occurred. 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/10/13 Afternoon Session 



112 



THE COURT : And then you went to the 
Wikileaks website and accessed them that way? 

THE WITNESS : You cannot navigate to them 
from the home page of the Wikileaks.org website, 
meaning you could not click on anything on that home 
image that would take you to these documents . 

THE COURT: I think I understand. All 

right . 

THE WITNESS: If I may expound on that. I 
believe there was a question in regards to, could the 
general public find these on the Wikileaks website just 
by going to the main website and presumably they 
wouldn't. They would find them doing a search, but not 
going to the website directly. 

THE COURT: Okay. I'm still in the same 
position I was in before Prosecution Exhibit 110 comes 
in . 

CAPTAIN MORROW: We'll withdraw the 

objection . 

THE COURT: To the (INAUDIBLE) has the same 
rulings . It ' s admissible . Do you want to give it to 
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me, I'll admit it. 

CAPTAIN TOOMAN: Retrieve defense Exhibit 
fox trot and Prosecution Exhibit 110 for the witness, 
and, Your Honor, that's exhibit fox trot and I'm going 
to hang onto this . 

THE COURT: Exhibit fox trot is admitted. 

CAPTAIN TOOMAN: Ma'am, permission to 
publish Prosecution Exhibit 110. 

THE COURT: Go ahead. 

BY CAPTAIN TOOMAN: 
Q I'm placing on the overhead Prosecution 

Exhibit 110, page 9. Agent Mander, you spoke on direct 
about a number of Intel Link searches that you found 
that corresponded to things on Prosecution Exhibit 110, 
correct? 

A I did not actually find the Intel links 

searches. That was someone else from the forensics 
team. 

Q You look at the Intel Link searches and 

testified that some of the things — the terms searched 
were items that were similar to things on Prosecution 
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Exhibit 110, correct? 

A That ' s correct . 

CAPTAIN TOOMAN: At this time I'd like to 
retrieve Prosecution Exhibit 81 and ask the witness to 
move to the panel box. 

THE COURT : All right . 

BY CAPTAIN TOOMAN: 
Q I'm handing the witness what's marked as 

Prosecution Exhibit 81 . 

Agent Mander, what I'd like to do is we're 
going to go through this list and I ' d like you to tell 
me whether or not there are any searches in Prosecution 
Exhibit 81 that correspond with the item on the list. 
Okay? 

CAPTAIN MORROW: Your Honor, the government 
will stipulate to that. There are no (INAUDIBLE) . 

THE COURT: What do you want him to do? 

CAPTAIN TOOMAN: Your Honor, the government 
highlighted I think three instances where PFC Manning, 
or, rather, I should say, computers associated with PFC 
Manning searched for terms that correspond with items 
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listed on this list . 

THE COURT : You want to go through all of 
the ones where they don't correspond, and government 
you're willing to stipulate the those three are the 
only ones that correspond? 

CAPTAIN MORROW: Yes, Your Honor. 

THE COURT: In light of that, do you need 

to continue? 

CAPTAIN TOOMAN: No, ma'am. I will 
retrieve Prosecution 81 from the witness. I'll hand 
that back to the government . 

BY CAPTAIN TOOMAN: 
Q Agent Mander, if you would please return to 

the witness stand. I'm going to hand you Prosecution 
110, and I'd like for you to count how many items are 
listed in that exhibit, please? 

A Could you define the word item? 

Q I'm sorry, under the United States. I 

think it starts on page 9 . 

A (Witness reviewing document.) 

You say items there are bullets. 
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CAPTAIN TOOMAN: I'll retrieve the exhibit 
from the witness and I will publish this if that ' s all 
right with Your Honor? 

THE COURT: That's fine. 
BY CAPTAIN TOOMAN: 
Q Page 9 of Prosecution Exhibit 110 . So 

Agent Mander, if you could please count the items on 
under United States there? 

A Can you move it down a little bit? 

Q Sure . This way? 

A Yes, that's fine. 

Q Okay . 

A When you say items, we're talking about the 

bulleted items, the subbullets? 
Q Yes . 

A They're at least five things that I can see 

different categories, I guess you could say. 

Q Let ' s go with important bulk databases . 

How many items are listed under important bulk 
databases? 

A There are three categories of items . 
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Q The next is federal politics? 

A Correct . 

Q How many items are listed there? 

A There are six. 

Q Okay . And then next do you see military 

intelligence. I'm going to move this up so we can see 
all of that subsections. And if you could please count 
I think on here count each bullet and subbullet — 
would you agree with me that the subbullet s are 
different than the main bullet? 

A Sure, yes. 

Q Or unique in some way? 

A Yes . 

Q In you would count those bullets for me . 

A Appears to be 21 bullets there. 

Q Okay. And I'm now going to remove page 9 

of the exhibit and put on page 10 to the overhead. Can 
you see that okay, Agent Mander? 

A Yes. 

Q We're still under military intelligence. 

So we're continuing from 21? 
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A (Witness reviewing document . ) 

Fifty-five excuse me 56. 
Q Fifty— six visibles on the screen there? 

A Yes . 

Q And the last one you see just for the 

record is blueprints and floor plans of all unmentioned 
facility in the federal relocation arc including 
historical ones? 

A That ' s correct . 

Q So 54 to there under military and 

intelligence, correct? 

A Didn't I say 56? 

Q I'm sorry, 56. I'm now moving page 10 up. 

How many under banking? 

A There two bulleted items . 

Q And one under environment? 

A That is correct . 

Q And two under media? 

A That is correct . 

Q And two under religion? 

A That is correct . 
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Q I'm removing page 10 and placing page 11 on 

the overhead and will continue with religion. How many 
more do you have there? 

A There are six more on this page. 

Q I'm removing page 11 and returning 

Prosecution Exhibit 110 to the court reporter. 

CAPTAIN TOOMAN: No further questions, Your 

Honor . 

THE COURT: Redirect? 

CAPTAIN MORROW: No, Your Honor. 

THE COURT : Temporarily excuse or 
permanently excuse (INAUDIBLE) . 

CAPTAIN MORROW: Temporary, Your Honor. 

THE COURT : Agent Mander , you ' re 
temporarily excused. Don't discuss your testimony or 
knowledge of the case with anyone other than counsel 
(INAUDIBLE) . You can step down. 

The presentation of your case the next 
piece of it is stipulated of expected testimony or 
is it a witness? 

MAJOR FEIN: The witness is sitting right 
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out here ready to go . 

THE COURT: A long or a short witness? 
MAJOR FEIN: United States thinks pretty 

short . 

THE COURT : Does either side have any 
objection to continuing? 

MR . COOMBS : No , Your Honor . 

MAJOR FEIN: The United States calls 
Ms . Sheila Glenn . 
Whereupon, 

SHEILA GLENN, 

called as a witness, having been first duly sworn to 
tell the truth, the whole truth and nothing but the 
truth, was examined and testified as follows : 

DIRECT EXAMINATION 
BY CAPTAIN OVERGAARD: 
Q And you are Sheila Glenn? 

A Yes, I am. 

Q You work at Fort Meade, Maryland? 

A Yes, I do. 

Q What unit do you work for at Fort Meade? 
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A I work for Army counterintelligence 

( INAUDIBLE) center . 

Q And what is a MI (INAUDIBLE)? 

A (INAUDIBLE) current counterintelligence 

activities to the protect classified information and 
technologies and to detect, identify foreign threats 
against U.S. Army . 

Q And do you work for a particular subgroup 

under that? 

A Yes , I do . I work for the Army 

counterintelligence Center. 

Q What is the Army Counterintelligence 

Center? 

A Army Counterintelligence Center produce 

timely accurately comprehensive multi— discipline 
analysis to support combat terrorism programs, ground 
system technologies, and investigation operation 
activities . 

Q And do you work for a specific branch under 

the Army Counter — 

A Yes , I do . 
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Q What branch is that? 

A I work form cyber counterintelligence 

assessment branch. 

Q And what does a cyber counterintelligence 

assessment branch do? 

A That counter cyber intelligence assessment 

branch identifies and performs analysis on cyber 
counterintelligence threats to the United States Army. 

Q And what is your job at the Army at the 

cyber counterintelligence branch? 

A My job is the (INAUDIBLE) certain analysts 

and my job is to (INAUDIBLE) and also soldiers and also 
to edit and review documents for content, accuracy, 
and. 

Q How many analysts do you have there? 

A We have five analysis that work under me . 

Q How long have you been in that senior 

analyst position? 

A I've been in that position for two years. 

Q How long have you been with the 

(INAUDIBLE) ? 
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A Since 2000. 

Q What did you do before that? 

A I was in military for 20 years and I 

retired as Sergeant First Class. 

Q What did you do in the military? 

A I spent five years as a crypto (INAUDIBLE) 

equipment repair, 15 years as an intelligence analyst. 

Q What kind of intelligence analyst? 

A All source intelligence analyst . 

Q And what has been your focus at the 907 . 

You said you're under the cyber assessments branch? 

A My focus is cyber counterintelligence. 

Q And what does that mean? 

A That means that I look at the foreign cyber 

threat, identify and assess that threat to throat 
United States Army technologies and programs . 

Q What sorts of — you say there are five 

analysts that work would under you? 

A Yes . 

Q What sorts of work product do the cyber 

analysts in the cyber CI branch of A6 produce? 
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A The cyber CI analyst produce special 

reports, counterintelligence notes, input the system 
and input the (INAUDIBLE) cyber inputs. 

Q We'll just focus on the A6 special reports 

prepared by the cyber CI branch. Can you tell us how 
that one is distinct from the other ones that you 
named? 

A The A6 special report is a comprehensive 

document . It uses I the full spectrum analysis and it 
uses predictive analysis. 

Q And are they different types of these 

special A6 reports? 

A Basically A6 special reports based on 

requirements, request of information, or 
self-initiated . 

Q What's the purpose of this self-initiated 

cyber CI special report? 

A In a self —initiated report we identify 

potential threat to U.S. Army and we inform the 
commander about that treat to the organization. 

THE COURT : You said there are three of 
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them, requirements, something else and? 

THE WITNESS: Request information. 

THE COURT : Thank you . 

BY CAPTAIN OVERGAARD: 
Q Just focusing in on the self-initiating 

cyber CI special reports, can you tell us how those are 
prepared? 

A Our first analyst comes up while doing 

their research they come across some information that 
they think might be of a CI interest in the United 
States Army. If it is, then they talk about it with 
their supervisor and see if there's something that, you 
know, the supervisor will approve for them to go ahead 
and produce . 

So then an analysts list what they know and 
what they don't know about that event or organization 
or whatever their writing about. Once they look at 
what they have and what they don't have, then they 
start doing research . They do the research on 
classified and unclassified reporting. 

Q Where do they conduct this research? 
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A They conduct this research on classified 

systems, SIPRnet and unclassified systems. 

Q What kinds of things are they looking at 

when they are conducting their research? 

A They ' re looking at everything . They ' re 

looking at human reporting, they're looking at a lot 
(INAUDIBLE) imagery reporting and massive reporting. 

Q So after they — after an analyst does this 

research, what's the next step to in creating the 
self-initiating special report for cyber CI? 

A Once they finish their research, the 

analyst look at the order of the stuff they want to 
compile . So basically they do the outline and they put 
the information that they collected within that outline 
and then they need to answer the questions, the who, 
what, why, where, and how, and then they want to see 
what ' s next and then they also look at the impact 
against U.S. Army interests and U.S. interests. 

Q And then do they — when do they start 

writing the product? 

A After they collect all the information and 
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put it into the outline then they start writing the 
product . 

Q And after — I guess what ' s the process 

then for writing that product? 

A Okay. For writing the product you pull all 

intelligent information together. You look at the 
impact . You go through the information and then you 
put it in a template . Template you have a template for 
these reports . You put it in a template and make sure 
that you can answer all the who, what, why, where, and 
what ' s next . 

Q And after that report is drafted, what 

happens to it? 

A After the report is drafted it goes to the 

senior analyst who reviews it for content, accuracy, 
and grammar, and once they senior analyst reviews it, 
then it goes out for coordination, external 
coordination . 

Q I'm going to step back a little bit. 

What ' s the content and accuracy verification? What 
does that entail? 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/10/13 Afternoon Session 



128 

A When we look at it for content and 

accuracy, we're making sure that information within the 
report is correct . We fact check the sources that are 
used in the report to make sure that they agree with 
the information within the report states and then we 
check for grammar . 

Q And then you said you send it out for 

coordination? 

A Yes. 

Q What does that mean? 

A When we send it out to coordination to 

external sources, we send it to other intelligence 
agencies so they can actually review the report to make 
sure that have the information accurately. 

Q And what happens after the external 

coordination? 

A When we did get our results back from the 

external coordination by checking the comments that the 
organizations put within the report and if we agree 
with the comments then we incorporate them within the 
reports . If we disagree with the comments then we put 
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an alternative analysis statement in that report . 
Q Is that required? 

A Yes, it is. 

Q And what happens after the external 

coordination, what happens to the product next? 

A External coordination of the products 

reviewed by the branch chief . 

Q It goes — what, if anything, is new added? 

A If anything is new added it goes back to 

the field analyst who reviews that information and then 
it goes to the branch chief . 

Q What does a branch chief do? 

A The branch chief reviews the product again 

for content, accuracy, and grammar. 

Q What happens after that? 

A After the product is reviewed by the branch 

chief then it goes to the editors for them to review 
it. 

Q Again, for content and accuracy? 

A They review it for grammar and content — 

grammar and accuracy . They don ' t review it for 
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accuracy, they review it for grammar. 

Q So what happens after the editing is done? 

A Once the editors finish their job then it 

goes to the director or deputy director for review for 
content, accuracy, and grammar. 

CAPTAIN OVERGAARD: Your Honor, I'm going 
to retrieve prosecution 45 for identification. 
BY CAPTAIN OVERGAARD: 

Q I'm handing Prosecution Exhibit 45 for 

identification to the witness. Can you tell us what 
that is? 

A It ' s a A6 special report . 

Q How do you know that? 

A Because it states on the top of the 

document A6 special report and it has an A6 serial 
number on it . 

Q And you're familiar with those documents? 

A Yes, I am. 

Q How are you familiar with it? 

A We write them. 

Q Have you written them yourself? 
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A Yes , I have . 

Q And what type of product is in that 

document or is that report in particular? 

A This is a self —initiated document . 

Q And who wrote that product? 

A Ms. Mike (INAUDIBLE). 

Q Who is Mike Corvat? 

A He was the senior analysis at the time. 

Q What was your involvement in creating that 

product ? 

A Mike discussed the subject with me and I 

reviewed it for content and grammar and accuracy . 

Q So you're familiar with the content? 

A I'm familiar with the content, yes. 

Q And why did you review the product? 

A Because we have a two review process within 

our organization. 

Q Is this a product you reviewed in 2008? 

A Yes, it is. 

Q Is it different in any way? 

A Yes, it is. 
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Q How is it different? 

A It's been declassified and is missing 

notes . 

Q Is the content otherwise the same? 

A Yes, it is. 

Q And what happened to the product, what 

happened to this product in particular after it went 
through the process that you discussed before? 

A It was posted to our website. 

Q Where is your website? 

A On SIPRnet and JWICS . 

Q Is that product still on the — 

A Yes, it is. 

Q How do you know that? 

A I checked it . 

Q (INAUDIBLE) United States moved to 

admission what has been marked as Prosecution 
Exhibit 45 for identification into evidence as 
Prosecution Exhibit 45 . 

CAPTAIN TOOMAN: No objection, Your Honor. 

THE COURT: May I see it, please? 
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Prosecution Exhibit 45 for identification is admitted. 
Does the witness need the document back? 

CAPTAIN OVERGAARD: Yes, ma'am. 
BY CAPTAIN OVERGAARD: 
Q Ms. Glenn, can you tell us the name of that 

product that I handed you? 

A Wikileaks.org on— line reference to foreign 

intelligence services or insurgents or terrorist 
groups . 

Q What is that letter and number combination 

under the title? 

A There is the production center, first four 

digits, the second is the function code, the third is 
the serial number, and the last is the fiscal year. 

Q And under that what is the publication date 

of this document? 

A 18 March 2008. 

Q And how about the information cutoff date? 

A 28th February 2008. 

Q Can you tell us what the information cutoff 

date means? 
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A That ' s the last current reporting that ' s 

contained in this report . 

Q What does it say under the publication 

date? 

A Last security information, unauthorized 

disclosure subject to criminal sanctions . 

Q What is the national security information? 

A Information that has been determined that 

it needs to be protected from unauthorized release. 

Q What specifically types of national 

security information is in here? 

A Intelligence reports produced by 

originators . 

Q And you already us what the external 

coordination means, but can you tell us what that line 
represents? 

A The coordination? 

Q Yes . 

A The organization that perform the external 

coordination . 

Q So that it was sent to you to coordinate 
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with? 

A Yes . 

Q And how about that next line? Can you tell 

us what that means? 

A Which one? 

Q The product response to headquarters, 

Department of Army? 

A — that's. 

THE COURT: Can we move this so you can 
follow along. 

CAPTAIN OVERGAARD: Yes, ma'am. I can 
publish a copy that I have right here, ma'am. 
BY CAPTAIN OVERGAARD: 
Q We ' re at the line beginning this product . 

Can you just tell us again what that means? 

A That's the production requirement that was 

used to produce this document, to authorize the 
production of this document . 

Q And then how about that last line there 

that says A6 production or product identification. 
What does that mean? 
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A That ' s the A6 serial number of that 

product . 

Q Does that serial number have any specific 

meaning? 

A The Army designates A6, the 08 is the 

fiscal year, and the serial number is the same as the 
one above (INAUDIBLE) the system numerical order of the 
reports . 

Q So there's just — 

A One, two, three, four, five, six on up. 

Q And you mentioned before that you have 

templates for your documents? 
A Yes , we do . 

Q What is the template for this document? 

A The template for this document is the 

title, purpose, executive summary, key judgments 
background, discussion, conclusion intel gaps, 
conclusion, and contact. 

Q Intel gaps and conclusions? 

A And point of contact . 

Q In 2008 that was a template you used? 
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A Yes, in 2008 that was the template we used. 

Q Can you just tell us a little bit about how 

this self-initiated product was prepared, this specific 
product ? 

A This product was doing research and came 

across Wikileaks.org and he thought it was a CI 
concern . 

CAPTAIN TOOMAN: Objection. This witness 
would have no personal knowledge of what prompted 
Mr . Horbach to write this document . 

BY MS. OVERGAARD: 
Q Are you testifying to your personal 

knowledge? 

A Yes, I am, because I discussed this with 

Mr. Horbach during that time frame. 

CAPTAIN TOOMAN: We would object based on 

hearsay . 

THE COURT : What ' s the relevance 

(INAUDIBLE) . 

CAPTAIN OVERGAARD: One moment, please, 
Your Honor. Ma'am, we'll stick with her personal 
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observation and not any objection. 

THE COURT: Objection, sustained. 
BY CAPTAIN OVERGAARD: 
Q Can you tell us what specifically was done 

to create this self-initiated product? 
A The steps? 

Q Yes . 

A The — 

Q The steps that Mr . Horbach took and the 

steps that you took in assisting him? 

A Mr . Horbach used the same procedures that I 

talked about before. I assisted in research and in 
reviewing and editing the document . 

Q And are these documents, are they usually 

32 pages long? 

A The documents can be much smaller, five 

pages, or they can be much larger, 150 pages. 

Q What's the average, what are they usually? 

A Average usually about 20 to 30 pages. 

Q And let ' s talk a little bit about the 

content of this report . Do you know what the purpose 
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of this document is? 

A Yes . The purpose of this document was to 

assess the counterintelligence threat on the U.S. Army 
by Wikileaks.org website. 

Q According to the report and your knowledge 

of the report, what is Wikileaks? 

A Wikileaks is a organization that exposes 

illegal activity. 

CAPTAIN TOOMAN: Objection, Your Honor. I 
don't believe this witness is in a position to 
determine the legality of the Wikileaks (INAUDIBLE) . 

CAPTAIN OVERGAARD: She's testifying about 
what the product actually says . 

THE COURT: All right. I'm not taking her 
testimony to be a legal opinion of whether something is 
legal or illegal . I'll take it to what purports to be 
illegal activity. Go ahead. 

CAPTAIN OVERGAARD: The purpose of 
testimony is only to elicit what is actually in the 
document not what Wikileaks is or is not, but what is 
written in the document . 
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THE COURT: Go ahead. 
BY CAPTAIN OVERGAARD: 

Q Can you tell us what Wikileaks is according 

to this report? 

A According to the report, it says that intel 

of Wikileaks website is to expose unethical practices 
and illegal (INAUDIBLE) and wrongdoing with respect to 
corrupt corporations and governments . 

Q And does the report comment on whether or 

not Wikileaks is a news organization? 

A Yes, it was. 

Q And what does it say? 

A It says that Wikileaks . org is not 

considered a news organization. 

Q And does it give some reasons for that? 

A Yes, it does. It says that Wikileaks does 

not vet their sources . Wikileaks does not put out 
overview. Wikileaks does not provide source checking 
or fact checking, and Wikileaks does not provide — 
Wikileaks does not confirm the accuracy of the 
information . 
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Q Does it talk about how Wikileaks releases 

information? 

A Yes, it does. 

Q What does it say about that? 

A It says Wikileaks . org uses anonymous 

methods to post the information to the sites . It says 
Wikileaks.org uses its own code and software which can 
open SSF (INAUDIBLE) difficult for foreign governments, 
law enforcement agencies, and foreign businesses to 
determine where a leak document was and who was 
responsible for leaking the document . 

Q Can you tell us what page you ' re looking 

at? 

A I'm looking at page 5 . 

Q What paragraph was that? 

A Paragraph 3 . 

Q Does it talk about — does this product 

further talk about what type of behavior, this 
anonymous releasing encourages? 

A Yes . The document says that the anonymous 

behavior encourages — let my get the exact words . 
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It says that the Wikileaks.org is normally 
(INAUDIBLE) activities such as a theft of data, 
documents, proprietary information and intellectual 
property, possible violations of national security laws 
regarding, espionage and possibly a violation of civil 
laws in (INAUDIBLE) within the United States and 
foreign countries . 

Whistle blowers are in (INAUDIBLE) violate 
laws (INAUDIBLE) whistle blowers protected from 
retaliation (INAUDIBLE) that in countries that have 
such laws on page 20. 

Q What paragraph on page 20 were you looking 

at? 

A Page 20, paragraph 1. 

Q This one or that one? 

A That one . 

Q Okay. The top paragraph, the half 

paragraph? 

A Page 19 it starts. 

Q According to this what threat does 

Wikileaks pose? 
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A Wikileaks (INAUDIBLE) first protection 

cyber intelligence — first protection, 
counterintelligence, information security, and 
operation security threat . 

Q That's in the key judgments? 

A Yes, it is. 

Q And what else or what does the key judgment 

say about how it does this, how Wikileaks does this, 
just looking at key judgments on page 3? 

A Okay. It says, recent on-line espionage 

release of DoD and sensitive and classified information 
provided foreign terrorists groups and insurgents and 
other foreign adversaries with potentially actionable 
information for targeting U.S. forces. 

Q Does the report discuss any examples of 

information that are posted on Wikileaks? 

A Yes . This report has three examples . 

Q What were those three examples? 

A The first example was the release of 

(INAUDIBLE) for troops deployed in Iraq and 
Afghanistan. The second example was release of a 
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standard operation procedures for joint task force. 
The third example was a classified document released 
that is produced by national ground intelligence 
center . 

Q What information in particular according to 

this report was in the TONE, the table of equipment 
that you just mentioned? 

A Report . 

Q Just in general what is in the TONE? 

A The TONE had a list of all (INAUDIBLE) that 

was deployed in Afghanistan and in Iraq. 

Q And did the products say anything about the 

dangers of releasing that information? 

A Yes. It said that the products stated that 

the release of that information could allow foreign 
intelligence service terrorist groups, Iraqi insurgents 
to conduct attacks against U.S. Army (INAUDIBLE) . 

CAPTAIN TOOMAN: Relevance, Your Honor. 
THE COURT: What is the relevance? 
CAPTAIN OVERGAARD: It's relevant to the 
accused ' s knowledge . 
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THE COURT: All right. Overruled. 
BY CAPTAIN OVERGAARD: 
Q You can continue . 

A The identification of vehicles, military 

vehicles, could be used to select specific types and 
replacements of improvised explosive devices . 

Q And then you also mentioned that there was 

a national ground intelligent report? 

A Yes, it is. 

Q What did that contain? 

A That report discussed (INAUDIBLE) warfare 

welfare and used against U.S. (INAUDIBLE) . 

Q And what was the classification of that 

document ? 

A That document was classified secret . 

Q And that was also released by Wikileaks? 

A Yes, it was. 

Q And according to the product what could be 

the impact to the United States if that were released? 

A The impact would be insight into a 

successful asymmetric warfare tactic technique and 
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protection operation against U.S. forces and coalition 
forces . 

Q And is this an intelligence product? 

A Yes, it is. 

Q And why is it an intelligence product? 

A Because it contains intelligent documents 

within it . 

Q Do the U.S. government entities rely on 

these intelligence? 

A Yes , they do . 

Q And was this product in particular used by 

other U.S. government entities? 

A Yes, they were. 

Q How do you know that? 

A Because people have discussed it . 

Q Was this product ever released outside of 

SIPRnet? 

A No, it wasn't. 

THE COURT: You're saying this product, are 
you talking about the (INAUDIBLE) . 

CAPTAIN OVERGAARD: I'm sorry, ma'am. I'm 
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talking about the A6 report . 

BY CAPTAIN OVERGAARD: 
Q Was this was the 2008 version that you're 

familiar with of the A6 report ever released outside of 
SIPRnet? 

A To my knowledge it was only posted on 

SIPRnet and JWICS and never released out of those two 
sites . 

Q Was it ever unofficially released? 

A To my knowledge, no, it wasn't. 

Q You ' re not familiar with this document 

being unofficially released anywhere else? 

A Unofficially released? 

Q Not officially, unofficially so — 

A I'm sorry. To my knowledge, this document 

was never unofficially released. 

Q So — 

A I'm never officially released. I'm sorry. 

Was it unofficially released? 

Q Yes . Do you know if this document was ever 

released? 
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A To my knowledge, the document was never 

released even unofficially. To my knowledge, this 
document was never un — officially released? 

Q Can you tell us — can you tell us, 

according to the conclusion of this document, what must 
be presumed about adversary access to Wikileaks? I'm 
just looking at page 21. 

A It must be presumed that Wikileaks 

organization have or will receive sensitive or 
classified documents in the future. It must also be 
presumed that foreign adversaries will review and 
assess any DoD or classified information posted on the 
Wikileaks.org website. 

Q Thank you . Was this document ever posted 

on Wikileaks? 

A Yes, it was. 

Q And how do you know that? 

A Because I was informed by an individual who 

saw on it Wikileaks . 

Q Do you have firsthand knowledge? 

THE COURT: Sustained. 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/10/13 Afternoon Session 



149 

BY CAPTAIN OVERGAARD: 
Q Do you have firsthand knowledge of that? 

A Yes , I do . 

Q What is the firsthand knowledge of that? 

A I received a phone call . 

THE COURT: Sustained. 

BY CAPTAIN OVERGAARD: 
Q Did you see the product? 

A It was e— mailed to me . 

Q And it was from Wikileaks? 

A It was e— mailed to me from somebody who 

took it off of the Wikileaks. 

Q How do you know that? What did it look 

like? 

A It looked like the exact same document that 

was posted on our website. 

Q Did it have any particular identifying 

marks on it that made you that think it was from 
Wikileaks? 

A No, not the document that I received. 

Q Okay . 
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A Because I received it on our classified 

system. 

Q Okay . Thank you . 

THE COURT: Cross? 

CROSS EXAMINATION 
Q I'm going to retrieve that exhibit from 

you, Prosecution Exhibit 45. Thank you. 

CAPTAIN TOOMAN: Ma'am, I'm going to 
publish this . 

THE COURT: Go ahead. 
BY CAPTAIN TOOMAN: 
Q I'm now publishing page 1, Prosecution 

Exhibit 45. Ms. Glenn, my first question to your is: 
You talked on direct about the title of this document, 
correct? 

A Yes . 

Q And you read it to the Court . Would you 

agree that the title of this document actually has a 
question mark at the end? 

A Yes, it does. 

Q And so that would suggest, would you agree, 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/10/13 Afternoon Session 

151 

that we don ' t know the answer to that question or this 
document is going to set out to answer that question? 
Would you agree with that? 

A Could you repeat the question? 

Q Sure . You would agree that based on the 

title of this document, that is a question, that is we 
don't know whether foreign intelligence services, 
insurgents, or terrorist groups use Wikileaks as an 
on— line reference. 

Would you agree with that? The question 
mark would suggest that we don't know. Do you agree 
with that? 

A The question mark suggests that we can't 

confirm it . 

Q Okay . 

A Not that we don't know, but we can't 

confirm it . 

Q Okay. If we could confirm it there 

wouldn't be a question mark there, correct? 

A At that time, yes. 

Q I'm sorry? So if there were no question 
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mark there you would agree with me that that would 
suggest that foreign intelligence service, insurgents, 
and terrorist groups are using Wikileaks as an on— line 
reference? 

A During that time frame we couldn't confirm 

it. 

Q Okay. Now I'm going to remove page 1 from 

the overhead and place page 2 . You talked on direct 
about the stated purpose of Wikileaks, and I would 
direct your attention to the second paragraph from the 
bottom which is the one denoted by the unclassified 
paragraphs there. Do you see that? 

A Yes . 

Q You would agree with me that the stated 

intent of Wikileaks is to expose unethical practices, 
illegal behavior, and wrongdoing (INAUDIBLE) 
organizations or corporations, and oppressive regimes 
throughout the world. Is that accurate? 

A That was the stated intent . 

Q The stated intent is to not to assist 

foreign militaries, correct? 
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A I can ' t make that determination . 

Q Well, that wasn't stated, you would agree 

with that, correct? 

A That's not stated within the document, yes. 

Q Okay. Now, continuing to talk — I've 

removed page 2 from the overhead. I'm going to place 
page 6 on. Continuing to talk about the stated purpose 
of Wikileaks . 

I want to direct your attention to the 
first full paragraph there, the one with the U in 
parenthesis, starts Wikileaks.org. Go ahead and read 
that first paragraph there for me . I'll point to that 
paragraph with my pen . 

A Wikileaks.org — 

Q Just read it to yourself, ma'am? 

A (Witness reviewing document . ) 

Okay . 

Q Ma ' am, based on this report would you agree 

with me that one of the purposes or the goals of 
Wikileaks is a free and unrestrained press? Would you 
agree with that ma ' am? 
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A Based on this statement, yes. 

Q Removing page 6. Ma'am, I'd like to talk 

now a little bit about how these documents are created. 
Okay? Now, you talked about a few different ways in 
which one of these products would be initiated. 

You talked about it could be 
self —initiated, correct, and that's what happened in 
this case? 

A Yes . 

Q I ' 11 just ask you to say your answer out 

loud for the purpose of the court reporter . 
A Yes . 

Q Another way would be through an RFI? 

A Request for information, yes. 

Q Would you explain what this is? 

A That ' s when a command sends us through 

e-mail or a request for information on a particular 
item and then we would research it and use a product 
off of it. 

Q So if there were requests for information, 

and there wasn't a request for information in this 
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case, correct? 

A No, this is self —initiated . 

Q So no unit came to A6 and said, we think 

that maybe Wikileaks is using, or the enemy is using 
Wikileaks, we'd like you to look into it, correct, that 
didn't happen? 

A No request of information. 

Q You mentioned a third way in which one of 

these documents would be initiated. What was that, 
ma ' am . 

A A requirement . 

Q And could you explain what that means? 

A Of that through our production system a 

customer will put in a request for assessment and then 
we will perform that assessment based on their request . 

Q So if someone had said, hey, we think that 

maybe Wikileaks is getting used by the enemy, they 
could have used that process in order to have this 
product produced; is that correct? 

A Yes , they could have . 

Q And that didn ' t happen here , correct ? 
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A No, it didn't. 

Q Now, I ' d liked to speak now about sort of 

the process through which this is created. Once it's 
been initiated here we had self —initiation and then we 
talked about all the research that goes into it, right? 

A Yes . 

Q And I think you talked about in this case 

it would be Mr . Horbach or whoever drafted the document 
would have looked at JWICS; is that correct? 

A Yes . 

Q And so Mr . Horbach work look at JWICS and 

he would have been looking for any sort of intelligence 
that would have helped answer the question posed by 
this paper? 

A He would use that, but that wouldn't be the 

only source he would use . 

Q Sure, okay. Within JWICS is where the 

United States government keeps top secret information, 
correct? 

A There's other information on JWICS, not 

only top secret . 
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Q So you would have not only top secret 

information on JWICS, but other information as well? 
A Yes . 

Q There's a lot of information on JWICS? 

A Yes . 

Q You've got the SIPRnet and that includes 

secret and down, correct, and then JWICS is higher. So 
there's even more on JWICS? 

A Yes. 

Q And you talked about a number of things 

that would have been referenced when producing this 
document? 



A 


Yes . 




Q 


There ' 


s human? 


A 


Yes . 




Q 


Signet 


[sic] ? 


A 


Yes . 




Q 


Osent 


[sic] ? 


A 


Yes . 




Q 


Masent 


[sic] ? 


A 


Yes . 
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Q Did I miss any? 

A Imit [sic] . 

Q Okay. So all of those ints would have been 

looked at by the individual who drafted this document? 
A Yes . 

Q Pretty much the author of this document had 

just about all of the United States government ' s 
intelligence at their fingertips. Is that fair to say, 
with some very limited exceptions, they are looking at 
just about everything? 

A Yes . They was looking at just about 

everything, yes. 

Q Now, so the individual who drafted the 

document would have looked at all of this information 
and they incorporated that into their document? 

A If they found something. 

Q Sure. If they found something, if they 

found a source they would have noted it in this 
document and then after the document was written it 
would have gone out for external coordination, correct? 

A Yes . 



Provided by Freedom of the Press Foundation 



1 

2 
3 
4 
5 
6 
7 
8 
9 
10 
11 
12 
13 
14 
15 
16 
17 
18 
19 
20 
21 



UNOFFICIAL DRAFT - 6/10/13 Afternoon Session 



159 

Q And in this case Mr. Horbach looked at all 

of this information, all of JWICS, all the ints and 
then he sent it out to the national ground intelligence 
center, correct? 

A Yes . 

Q And they scrubbed it as well? 

A Yes . 

Q And so if they would have had any 

intelligence that maybe Mr. Horbach missed or maybe 
didn't have access to they could have added it on this 
document , correct ? 

A Yes . 

Q And so this external coordination also is a 

process through which we can make sure we have as much 
intelligence as possible in forming this paper, 
correct? 

A Yes . 

Q Now, I want to talk about the document 

itself. Through the document there are footnotes, 
correct? 

A There are end notes . 
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Q End notes and what is the purpose of an end 

note? 

A The purpose of the end note is to list 

where you acquired the information from. 

Q So it ' s the source, is that accurate? 

A Yes, it's the source. 

Q So if there was an intelligence report that 

said Captain Tooman eats too many cookies and there 
would be an end note and you ' d have the source of that 
information? 

A Yes . 

Q And it might be my mother or someone else? 

A Yes . 

Q That ' s how I know it would work? 

A Yes . 

Q I want to — I'm going to publish page 11. 

I ' 11 direct your attention to sort of the middle of the 
paragraph here we have a paragraph that was secret, no 
foreign, it's been lined through. It starts 
intelligence indicates that insurgents . Right here . 
Do you see that? 
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A Yes . 

Q That says intelligence indicates that an 

insurgents in Afghanistan have recovered several 
(INAUDIBLE) systems and then we have an end note. And 
we have the unclassified version of this document, but 
if we were looking at the classified version we can go 
to number the 12 at the back and you can see the source 
of that? 

A Yes . 

Q And we would know from looking at that the 

classified document, how we know that insurgents in 
Afghanistan have recovered several warlock systems? 

A Yes . 

Q That would be some intelligence that was 

gathered from the JWICS system or from some other 
source that the author referenced? 

A Yes . 

Q Or it could have been something that the 

external coordination added to the document as well, 
correct? 

A Yes . 
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Q I'm going to remove page 11. Now, would 

you agree with me that this document, there are over 50 
end notes? 

A I'm not exactly sure how many end notes 

it ' s in the document . I don ' t remember . 

Q I'm going to hand the witness what's been 

marked as Prosecution Exhibit 45. 

Would you please take a look at that and 
just let us know how many end notes there are? 

A Fifty— five end notes. 

Q I'm going to retrieve the exhibit from the 

witness . 

So within this document there are 55 facts 
or pieces of intelligence that we the government had 
verified? That's how we know it, correct? 

A Yes. Fifty— five pieces of information of 

end notes that list sources . 

Q Would you agree with me that if we had a 

source for something it would be listed? 

A If there was a source for something in that 

document, if the analyst found it, it would be listed; 
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but that does not mean that the analyst did not find 
all the sources . 

Q Okay . 

THE COURT : That does not mean that the 
analyst did not find all the sources? I don't 
understand that . 

THE WITNESS : So let ' s say an analyst is 
writing product and some sources have not been 
published yet. So, therefore, that analyst who wrote 
that product would not have all of the sources for that 
document, but he will write the documents based on the 
sources that at the time was available. 

BY CAPTAIN TOOMAN: 
Q So there might be some intelligence out 

there that he just hasn't seen yet? 
A Yes . 

Q And he wouldn ' t incorporate that into the 

document . 

A Because he has not seen it? 

Q It would be impossible to incorporate it? 

A Yes . 
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Q Now, I'm going to publish page 20 and I'd 

like to focus on the one of the areas in the template 
called intelligence gaps . 

Ma ' am, you would agree with me that an 
intelligence gap is something that we don't know, 
correct? 

A Not always . 

Q Okay . You would agree with me that it ' s 

something that — a gap is there's something missing, 
correct? 

A Not always . 

Q What is a gap? 

A Sometimes a gap could be information that 

we cannot confirm. 
Q Okay . 

A We know it, but we can't confirm that it's 

actually true . 

Q Okay . And you would agree with me that in 

cases where you know something you would cite it, 
correct, you would cite a source for it? If you know 
it you cite the source for it, correct? 
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A If the source can confirm it — we can know 

something but we can't confirm it. So we cannot put it 
in the document because it ' s not — it ' s not 
corroborated . 

Q When you say you can't confirm it, you mean 

you don't really know, you can't say for sure that you 
know in? 

A I can ' t say for sure that I know it . 

Q If you had even any sort of source or 

intelligence you would have — would you cite that in 
the document, correct? You wouldn't have a source for 
something and then just leave that source out, right? 

A If I can't confirm the source, yes, I would 

leave it out . 

Q Because you can't confirm it, you don't 

know for sure? 

A Not necessarily that I don't know for sure. 

I cannot not confirm the source is accurate. 

Q If you knew for sure, you would put the 

source in there, right? 

A If the source is verified, yes, I would put 
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the definition in there. 

Q Now, I want to talk about these 

intelligence gaps . I'd like to direct your attention 
to the third one . 

You ' d agree with me that this says would 
the Wikileaks.org website be used by FISS, that's 
foreign intelligence services; is that correct? 

A Yes . 

Q Foreign military services, foreign 

insurgents, or terrorists groups to collect sensitive 
or classified or U.S. Army information posted to the 
Wikileaks.org website? That's listed as an 
intelligence gap, correct? 

A Yes. 

Q So that's something you can't confirm? 

A No, we can't confirm that. 

Q And would you agree with me that there is 

no end note at the end of that intelligence gap, 
correct? 

A Intelligence gaps we don ' t put end notes on 

intelligence gaps . 
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Q Because you don ' t have sources for them? 

A They ' re gaps . 

Q There is not an end note, but there is a 

question mark? 

A Yes . 

Q Again, a question mark would indicate that 

it's something that we are looking for the answer to, 
right? 

A Something we can ' t confirm the answer to . 

Q If we had the answer, it wouldn't be in the 

intelligence gap section, correct? 

A If we can't confirm it then we put it in 

the intelligence gaps . 

CAPTAIN TOOMAN: Your Honor, I have no 
further questions. I'm going to remove page 20 of 
Prosecution Exhibit 45 and return it to the court 
reporter . 

THE COURT: Redirect? 

CAPTAIN OVERGAARD : Just one moment , 

please . 

REDIRECT EXAMINATION 
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Q So you started explaining about 

intelligence gaps a little bit when defense asked you 
about it, but I want to hear in own words what is an 
intelligence gap? 

A That is easier if I give you an example. 

Q Okay . 

A Let's say I look at an organization. I 

know the organization name. I know that organization 
has five branches. I know four of the branch names, 
but the fifth branch I'm not exactly sure what the name 
is . I have an idea of what it could possibly be based 
on the structure, but I cannot confirm if that's the 
actual name. That's an example, one example of an 
intel gap . 

Q How about using the example that defense 

pointed out. What can be confirmed, or can you explain 
why that's an intelligence gap, what's confirmed and 
what needs verification? How does that work? 

A In this particular example we know that 

intelligence organization and terrorist groups perform 
open source intelligence, but we cannot confirm if they 
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actually visit that cite and looked at the information. 
CAPTAIN OVERGAARD : Just one moment , 

please . 

BY CAPTAIN OVERGAARD: 
Q And then after the intelligence gaps, what 

does the conclusion says starting with in addition? 

A It says, in addition, it must also be 

presumed that foreign intelligence — foreign 
adversaries will arrive and assess any DoD sensitive or 
classified information posted to the Wikileaks.org 
website . 

Q Thank you. 

THE COURT: (INAUDIBLE) 

RECROSS EXAMINATION 
BY CAPTAIN TOOMAN: 
Q Now, you said that an intelligence gap 

would be something that you can't confirm. You would 
agree that an intelligence gap would also be something 
we have no idea about? 

A It could be . 

Q It could be. And you talked just now about 
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presuming something. How do you define presume, ma'am? 
A How do I define presume? 

Q Yes . 

A That quote was based on historical analysis 

of what foreign intelligence services and terrorist 
organizations do . We know they conduct open source 
intelligence and we know that they are interested in 
classified and sensitive U.S. government information. 

So based on what we know we presume that 
they will look at that site if that information is 
posted there . 

Q But you have no intelligence that the enemy 

or those groups have ever gone to Wikileaks . org? 

A At that time, during that time frame we 

could not confirm it . 

Q And you also couldn't say if they were 

going to go there in the future? 

A We know that they do open source research . 

We know they have certain key words they use to search 
with, and we know if this classified information, that 
information will be reviewed and assessed. 
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Q And you presume that? You — 

A We know that they visit websites. 

Q You know they visit websites, but you don't 

know they visit Wikileaks? 

A We cannot confirm that they didn't visit 

Wikileaks . 

Q You have no intelligence to suggest that 

they have ever been to Wikileaks at that time? 

A We couldn't confirm it at that time that 

they visited Wikileaks . 

Q And if you would, ma'am, please, you've 

explained that conclusion, but what just the word 
presume, what does that mean to you, ma'am? 

A Presume? 

Q Presume . 

A Presume to me means that we will — presume 

means that we think that they will visit that website. 

CAPTAIN TOOMAN : Okay . Thank you , ma ' am . 
THE COURT: Any final redirect? 
CAPTAIN OVERGAARD: Yes, ma'am. 
REDIRECT EXAMINATION 
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Q You said on cross you could not confirm 

enemies saw Wiki leaks in 2008? 

A In 2008 we could not. 

Q How about in 2009? 

A In 2009, we could not. 

Q And how about in 2010? 

A In 2010, we could not. 

CAPTAIN OVERGAARD: Thank you. 
THE COURT: I just have one question for 
you to. You talked about the three different ways that 
reports are generated the self-initiate have had versus 
the RFI versus the . 

THE WITNESS: (INAUDIBLE) . 
THE COURT: In terms of frequency, how 
frequently are self-initiated reports generated versus 
the other two? Are they unusual? 

THE WITNESS: No, they're not. They're 
common. Self —initiated on our mission statement we 
identify, you know, threats to the United States Army 
counterintelligence threats to the United States Army. 
So we are always looking for threats to the United 
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States Army. So self —initiate the products are 
produced often within our organization. 

THE COURT : Any follow-up questions based 

on mine? 

CAPTAIN OVERGAARD: No, ma'am. 
CAPTAIN TOOMAN: No, ma'am. 

THE COURT : Temporary or permanent excuse 

(INAUDIBLE) . 

CAPTAIN OVERGAARD : Temporary . 

THE COURT : Ma ' am, you ' re temporarily 
excused. Don't discuss the case with anyone other than 
counsel of the accused while the trial is still going 
on . Thank you , ma ' am . 

Is there any further evidence either 
side want to put on the today? 

MAJOR FEIN: No, ma'am. 

MR. COOMBS: No, Your Honor. 

THE COURT: Before we recess the court I do 
want to go over a timeline for deciding today's issues 
on objections for Prosecution Exhibit 31, 32 and 109. 

I would like the parties to put in 
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writing the government what ' s the relevance of these 
what hearsay, nonhearsay purpose. Defense sort of 
put the issues (INAUDIBLE) if you will, the issue 
off on the table . 

I'm not going to have the government 
file first and then you file first. You have the 
gist of what they ' re bringing in . We can have an 
oral argument if they create something knew, then we 
can address it there. 

I understand we ' ve got a busy week and 
you all are bringing in witnesses and doing that . 
If we take a little bit of time to file these briefs 
and for me to rule. Are these exhibits going to be 
introduced with any other witnesses that are coming 
tomorrow or the next day? 

CAPTAIN MORROW: No, Your Honor. 

THE COURT : What ' s the window of time that 
we're looking at before we have to have that issue 
resolved? 

CAPTAIN MORROW: I believe the end of the 
week is probably sufficient to get this resolved. 
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THE COURT : Okay . What is a reasonable 
timeline in light of your schedules with witnesses and 
preparation and getting everybody here without delaying 
the proceedings to be able to come up with these 
filings . 

MAJOR FEIN: United States would offer 
three days . We ' 11 have it by COB on Thursday . 

THE COURT: COB on Friday, and you want me 
to rule by the end of the week . 

MAJOR FEIN: Thursday. 

THE COURT : You want me to rule Friday 

morning . 

MAJOR FEIN: Very short and concise, brief. 
We can go earlier, ma'am. 

THE COURT : Let ' s do Wednesday . Can you do 

that? 

MR. COOMBS: We are at a disadvantage 
because all of us are in court . The government has 
other counsel . 

THE COURT: If you get it to me by the end 
of the week and I rule on Monday, will that work? 
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MR. COOMBS: Yes, that will. 

CAPTAIN MORROW: I thought that it could be 
submitted by the end of the week and then move on . 
THE COURT: The following week? 
CAPTAIN MORROW: Yes. 

THE COURT : So we have a COB on Thursday . 
Does that work? That way if there's any issues we can 
address it on it Friday (INAUDIBLE) . 

MR. COOMBS: We're looking at COB Friday? 

THE COURT : We ' re looking at COB Saturday . 

MAJOR FEIN: Friday works, ma'am. 

MR. COOMBS: If you give me Saturday, I'll 
take Saturday . 

CAPTAIN MORROW : One moment , Your Honor . 

MAJOR FEIN: Saturday is fine as well 

ma ' am . 

THE COURT : We ' 11 do COB Saturday and what 
I would ask is you identify all that you know of and 
can you get me the copies of whatever of those 
authorities are that you have (INAUDIBLE) . 

MR. COOMBS: I'll get those to you. 
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THE COURT : Government , the same thing . 
Give them to me as soon as you can and I'll expect your 
briefs on Saturday and we'll go next week. 

CAPTAIN TOOMAN: Would you like hard copy 
or e-mail electronic? 

THE COURT: Both. Is there anything else 
we need to address today? 

MAJOR FEIN: No, ma'am. 

MR. COOMBS: Nothing, Your Honor. 

THE COURT: Start same time tomorrow. 

CAPTAIN MORROW: With respect to authority 
are you speaking specifically to the Internet archive 
of Twitter . 

THE COURT : No . I'm speaking legal 
authority . They cited three case . 

CAPTAIN MORROW: Related to the Internet 
archive, related to the authentication of the 
information . 

THE COURT: If you have any authority that 
is germane to this motion or any of the three 
objections . I believe they are the hearsay, 
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authentication, and relevance that you want me to — or 
that you already have that you want me to consider, I 
would appreciate it . More time it is always better for 
me . 

CAPTAIN MORROW: Yes, ma'am. 

THE COURT: Is there anything else we need 

to address? 

CAPTAIN TOOMAN: No, ma'am. 
THE COURT: The court is in recess. 
(Hearing adjourned at 6:51 p.m.) 
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